nicerfoundation[.]org[.]ng

The domain nicerfoundation.org.ng was a phishing site engaged in brand impersonation, specifically targeting users with an NFT scam under the guise of a 'foundation' brand. No drainer kit was identified, but the site operated as a fraudulent platform designed to deceive victims into interacting with malicious content. As of the latest verification, nicerfoundation.org.ng has been taken offline, though it previously posed an elevated risk to users.

Technical analysis of nicerfoundation.org.ng revealed limited detection, with only 1 of 95 VirusTotal security vendors flagging the domain. The domain was registered through GO54 Limited (formerly Whogohost Limited) on May 25, 2023, and resolved to the IP address 131.153.147.34, hosted by Secured Servers LLC in the US. It appeared on 2 security blocklists, PhishDestroy and Enkrypt, and had a Gridinsoft trust score of 0/100. The SSL certificate was issued by Let's Encrypt (R12), and the site returned an HTTP 200 status. MX records pointed to nicerfoundation.org.ng itself, and nameservers were nsa.whogohost.com and nsb.whogohost.com.

Users who interacted with nicerfoundation.org.ng should assume their credentials or wallet details may have been compromised. For NFT-related scams, revoke any token approvals granted to unknown contracts and transfer funds to a new wallet. For credential phishing, change passwords immediately, enable two-factor authentication, and monitor accounts for unauthorized activity. Report the domain to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities to aid in takedown efforts.