rareseanft[.]com

Analysis of rareseanft.com confirms its classification as an active NFT crypto drainer infrastructure, operational as of July 12, 2026. The domain was registered on September 26, 2025, through Ultahost, Inc., and currently resolves to IP address 84.200.205.134, hosted in Germany under the same provider. Infrastructure analysis reveals the use of Nginx as the web server, alongside client-side libraries including SweetAlert2, SweetAlert, and jQuery, which are commonly employed in fraudulent schemes to manipulate user interactions. The domain enforces HSTS and utilizes Google Hosted Libraries, potentially to enhance perceived legitimacy. The site presents itself as an NFT marketplace, as indicated by its page title: 'NFT Marketplace - Browse, create, buy, sell, and auction NFTs.' However, the domain is flagged by one security blocklist and is actively blocked by PhishDestroy. Ten of ninety-one security vendors on VirusTotal detect the domain as malicious, aligning with its categorization as an NFT scam. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites due to its accessibility. The domain returns an HTTP 301 redirect, though the destination remains unconfirmed. Nameservers are set to ns1.ultahost.com and ns2.ultahost.com, reinforcing the domain's ties to the hosting provider. Gridinsoft assigns a trust score of 0/100, further supporting its malicious classification. Defenders should treat this domain as high-risk infrastructure and prioritize blocking or monitoring its resolution and associated IP. No evidence suggests compromise of legitimate infrastructure; the domain appears purpose-built for fraudulent activity. Additional analysis of the redirect target and wallet addresses linked to the drainer is recommended to assess full attack scope.