rarible[.]io-nft[.]guru

Analysis of the domain rarible.io-nft.guru indicates it was actively involved in crypto drainer phishing operations targeting users of the Rarible NFT platform. As of July 23, 2026, the domain has been taken offline, though prior infrastructure analysis reveals it resolved to the IP address 172.67.191.135, hosted under Cloudflare, Inc. (AS13335) in the United States. The domain lacked an SSL certificate, a common red flag in phishing infrastructure, and was registered through Cloudflare, which is frequently utilized by threat actors to obscure ownership and hosting details.

The page title, 'Rarible,' directly aligns with the scam type identified in threat intelligence as an NFT scam, suggesting an intent to deceive users into interacting with fraudulent NFT-related services. The domain appeared on two security blocklists, PhishDestroy and CryptoFirewall, and was flagged by 12 of 95 security vendors on VirusTotal, further corroborating its malicious classification. Gridinsoft assigned a trust score of 0/100, indicating a high-confidence assessment of malicious activity.

While the domain is currently offline, defenders should treat any residual DNS records, cached content, or related infrastructure as compromised. Organizations are advised to block the domain and its associated IP at the network level, monitor for resurgence under similar naming conventions, and alert users who may have interacted with the domain prior to its takedown. The exact content of the phishing page remains unanalyzed, but the available evidence confirms its role in crypto drainer operations targeting NFT users.