marketplace-kintara[.]com

This domain, marketplace-kintara.com, is actively engaged in brand impersonation targeting Kintara, a recognized entity in digital asset marketplaces. Analysis indicates the site is designed to harvest user credentials under the pretense of a legitimate marketplace interface, as evidenced by its page title 'Kintara — Marketplace' and thematic alignment with the targeted brand. The threat type is classified as credential theft, with no direct evidence of a crypto drainer kit at this stage, though further inspection of the underlying codebase would be required to confirm the absence of such functionality. Infrastructure analysis reveals the domain was registered on June 15, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.30.13, which is part of a cloud-based infrastructure known for hosting transient malicious sites. Detection metrics show the domain is flagged by 4 out of 95 security vendors on VirusTotal, while it appears on 3 distinct security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors to lend superficial legitimacy to phishing sites. Google Safe Browsing currently lists the domain as malicious, further corroborating its fraudulent nature. As of the latest assessment, marketplace-kintara.com remains active, with no evidence of takedown or remediation efforts. The domain’s persistence, combined with its presence on multiple blocklists and low detection rate among security vendors, suggests a targeted campaign with limited exposure. Users are advised to treat the domain as hostile and avoid interaction, particularly those affiliated with Kintara or similar digital asset platforms. Organizations should update their web filtering rules to block the domain and its associated IP, while monitoring for related infrastructure that may emerge from the same registrar or hosting provider.