rarible[.]co[.]com

This domain, rarible.co.com, is flagged as a high-risk brand impersonation scam designed to deceive users of the legitimate Rarible NFT Marketplace. Analysis indicates the site specifically targets cryptocurrency and NFT enthusiasts by replicating the official platform’s interface, likely to facilitate fraudulent transactions, credential harvesting, or crypto asset theft. The threat type is classified as brand impersonation with potential secondary vectors such as crypto drainers or fake login portals, given the domain’s association with digital asset trading. Infrastructure analysis reveals multiple critical indicators of compromise. The domain resolves to IP address 158.94.208.115, hosted under AS202412 (Omegatech LTD) in Germany, a network frequently associated with malicious activity. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious, a detection rate that significantly exceeds typical false-positive thresholds. The site lacks an SSL certificate, a red flag for any platform handling financial or sensitive user data. Additionally, the domain appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, further corroborating its malicious intent. The page title, 'Rarible NFT Marketplace - Create, Buy & Sell Digital Assets,' is an exact replica of the legitimate site, demonstrating a deliberate attempt to mislead users. The domain is currently offline, but historical data suggests it was operational long enough to pose a substantial risk. Mitigation steps for this threat type require both technical and user-level interventions. Organizations should immediately block the domain and its associated IP (158.94.208.115) at the network perimeter, including DNS and web filtering systems. Security teams are advised to monitor for any residual connections to the IP or related infrastructure, particularly within environments where cryptocurrency transactions occur. Users who may have interacted with the site should revoke any connected wallet permissions, rotate credentials for associated accounts, and scan devices for malware. Given the domain’s impersonation of a well-known NFT platform, targeted awareness campaigns should be conducted to educate users on verifying domain authenticity, checking for SSL certificates, and cross-referencing official communication channels before engaging with any platform. Historical analysis of similar scams suggests that threat actors may re-deploy the domain or shift to alternative infrastructure, necessitating continuous monitoring of related indicators.