rari-nft[.]com

Analysis of rari-nft.com shows a newly registered domain that has been taken offline but exhibits multiple indicators of a crypto‑draining operation, specifically an NFT‑related scam. The domain was created on February 21, 2026 and is registered through Tucows Domains Inc. Its authoritative name servers are 1-you.njalla.no, 2-can.njalla.in, and 3-get.njalla.fo, which are commonly associated with disposable or rapidly re‑configured hosting. DNS resolution points to IP address 167.71.118.111, a server located in the United States and hosted by DigitalOcean, LLC, a provider frequently leveraged for malicious infrastructure due to its flexible provisioning. VirusTotal scans have recorded 11 detections out of 93 security vendors, confirming that a notable portion of commercial scanners flag the domain as malicious.

The site is listed on at least one public security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the consensus that the domain is being used for illicit activity. The stated scam type is an NFT scam, aligning with the broader classification of crypto drainer threats that aim to trick users into transferring cryptocurrency or NFTs to attacker‑controlled wallets. No public evidence of SSL certificates, HTTP response codes, or page titles has been disclosed, leaving the exact web content unverified.

Defenders should immediately add rari-nft.com to DNS and URL filtering rules, block outbound traffic to its IP 167.71.118.111, and monitor for any derivative subdomains or similar naming patterns that may be employed by the same threat actor. Continuous ingestion of threat‑intel feeds that reference the listed nameservers and the DigitalOcean hosting range will aid in early detection of re‑hosted variants. Given the domain’s recent creation and rapid takedown, the operational window was short, but the underlying infrastructure remains reusable, so proactive containment is advised.