riftonbase[.]art

This domain, riftonbase.art, is flagged for brand impersonation targeting Base, a cryptocurrency platform. Analysis indicates the site hosted a fraudulent "Rift NFT Giveaway," a common tactic to lure victims into disclosing wallet credentials or transferring assets under false pretenses. The infrastructure aligns with known drainer kit operations, where attackers deploy smart contracts to automatically siphon funds from connected wallets. Infrastructure analysis reveals the domain was registered on March 02, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 188.114.96.3 and is currently detected by 8 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and was previously blocked by at least one threat intelligence feed. No Google Safe Browsing (GSB) detections are recorded at this time, though the elevated risk level is justified by its association with active cryptocurrency fraud. As of the latest assessment, riftonbase.art has been taken offline, likely due to enforcement actions or hosting provider intervention. However, residual risk persists, as threat actors may re-deploy the same infrastructure under newly registered domains or shift to alternative hosting providers. Users who interacted with the site should revoke wallet permissions, monitor for unauthorized transactions, and verify smart contract interactions. Organizations should update blocklists to include the domain and associated IP to prevent future exposure.