rareearners[.]top

This domain, rareearners.top, is actively flagged as a high-risk credential phishing site. Registered on May 08, 2026, through Global Domain Group LLC, the domain remains operational as of August 06, 2026. Infrastructure analysis reveals it resolves to the IP address 163.61.188.108, with nameservers ns1.globaldnsnetwork.com and ns2.globaldnsnetwork.com, a configuration commonly associated with bulletproof hosting providers. The domain appears on at least one security blocklist, specifically PhishDestroy, and is detected by 3 out of 91 security vendors on VirusTotal, indicating confirmed malicious activity. The exact nature of the phishing content is not yet fully analyzed, though the domain name suggests an attempt to lure victims with promises of financial gain.

No specific brand impersonation or phishing kit has been confirmed in the available data. The registrar, Global Domain Group LLC, has been linked to other fraudulent domains in the past, though this alone does not confirm malicious intent. The hosting IP, 163.61.188.108, has not been widely reported in threat intelligence feeds, but its association with this domain warrants further scrutiny. Defenders should treat rareearners.top as an active threat.

Network-level blocking is recommended, particularly for organizations with users susceptible to financial scams. Security teams should monitor for connections to the IP 163.61.188.108 and the nameservers ns1.globaldnsnetwork.com and ns2.globaldnsnetwork.com, as these may indicate compromise or ongoing phishing campaigns. If internal logs reveal visits to this domain, immediate credential reset protocols should be enforced for affected accounts. Given the domain’s recent registration and active status, continued monitoring for new detections or infrastructure changes is advised.