rarible[.]com-nft[.]shop

Analysis of the domain rarible.com-nft.shop shows it was created on 21 February 2026 and quickly adopted for an NFT‑related crypto‑drainer campaign. The site is classified as an NFT scam, a subset of crypto‑drainer operations that aim to steal cryptocurrency by luring victims with counterfeit NFT offers. The domain has been listed on two security blocklists, PhishDestroy and ScamSniffer, indicating that at least two independent threat‑intel feeds have observed malicious activity associated with it. VirusTotal scans have recorded six detections out of ninety‑three submitted security vendors, reinforcing the malicious classification.

Current network measurements confirm that the domain is offline, suggesting the operators have taken it down or are temporarily suspending activity. Public data sources such as Google Safe Browsing, OTX, registrar WHOIS, IP/hosting details, SSL certificate information, and HTTP response codes are not presently disclosed for this domain, and the page title has not been captured. Consequently, defenders lack visibility into the underlying hosting infrastructure, geographic location, or certificate usage, which limits attribution and remediation depth. Given the available evidence, security teams should immediately add rarible.com-nft.shop to internal blocklists and configure web‑filtering solutions to deny any outbound connections to the domain.

Continuous DNS monitoring is advised to detect potential re‑registration or resurrection of the host. Analysts should also watch for related indicators, such as domains sharing the “rarible.com‑nft” pattern or similar NFT‑themed branding, and correlate any future VT detections with existing blocklist entries. Until more infrastructure details become available, the precautionary approach of full denial and ongoing surveillance remains the most effective mitigation.