planetaria[.]world

This domain, planetaria.world, is identified as a brand impersonation threat specifically targeting users of the Cosmos ecosystem. Analysis indicates the domain masquerades as a legitimate metaverse platform associated with Cosmos, likely to deceive victims into engaging with fraudulent services or disclosing sensitive information. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and branding align with common tactics used in asset diversion schemes. Infrastructure analysis reveals the domain resolves to the IP address 199.36.158.100 and is registered through GoDaddy.com, LLC. It has been flagged by 4 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. The domain appears on two security blocklists and is currently blocked by at least two threat intelligence feeds. The SSL certificate is issued by Google Trust Services, and the site employs technologies such as Firebase, HSTS, Google Analytics, and HTTP/3, which may be leveraged to enhance legitimacy or obfuscate malicious activity. The page title, 'Planetaria metaverse,' reinforces the impersonation of Cosmos-related services. As of the latest assessment, planetaria.world has been taken offline, reducing immediate exposure risk. However, the domain’s infrastructure remains registered and could be reactivated or repurposed for future campaigns. Users who interacted with the domain prior to its takedown should monitor for unauthorized transactions or account access attempts. Organizations are advised to update blocklists to include this domain and its associated IP address, while end-users should verify the authenticity of any Cosmos-related platforms before engaging with them. The remaining risk is classified as elevated due to the domain’s prior activity and potential for reuse.