nftpool[.]top

The domain nftpool.top was registered on October 14, 2025 through NiceNIC International Group Co., Limited. No SSL certificate is associated with the host, and the authoritative nameservers are keyla.ns.cloudflare.com and sean.ns.cloudflare.com, indicating that the domain is fronted by Cloudflare's DNS service. The domain resolves to IP address 104.21.91.221, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. When accessed, the HTTP response returns a Cloudflare 522 status code with the page title '522: Connection timed out', suggesting that the origin server is not responding. The site has been classified as a crypto drainer investment scam and is linked to an Airdrop Scam phishing kit.

Security telemetry shows a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. It is currently blocked by PhishDestroy. VirusTotal analysis recorded one positive detection out of ninety‑five scanners. Because the site is offline, no content has been captured, and the exact mechanisms used to drain cryptocurrency wallets remain unknown.

The lack of an SSL certificate prevents verification of any TLS fingerprint, and the solitary blocklist entry provides limited insight into the broader distribution of the malicious payload. Defenders should add nftpool.top to network‑level deny lists, enforce DNS filtering that includes the observed blocklist, and monitor for any traffic to the associated Cloudflare IP range. Threat‑intel feeds should be updated to reflect the registration date and the association with the Airdrop Scam kit. Continued scanning of the IP address for abnormal outbound connections is advised, and any future resolution to a live server should be re‑examined for malicious scripts or wallet‑draining code.