rariblenft[.]net

Analysis of rariblenft.net indicates a targeted brand‑impersonation campaign against the NFT marketplace Rarible. The domain was registered on 25 June 2025 through Gname.com Pte. Ltd. and is hosted on Cloudflare’s network (IP 172.67.167.83, AS13335, United States). Both authoritative name servers, holly.ns.cloudflare.com and quinton.ns.cloudflare.com, resolve to the same Cloudflare infrastructure, confirming the hosting provider. The site presents a page title of “Rarible,” matching the targeted brand, and is classified as an NFT scam in the intelligence feed.

No SSL certificate was observed, suggesting the service was delivered over plain HTTP before being taken offline. Threat intelligence sources provide concrete evidence of malicious activity: AlienVault OTX includes the domain in a single threat pulse, and a single security vendor out of ninety‑five flagged it on VirusTotal. Gridinsoft assigned a trust score of 0 / 100, and the domain appears on one external blocklist. PhishDestroy has already blocked the host, and the current status is recorded as offline, limiting immediate access to the payload.

Defenders should treat the domain as hostile. Recommended mitigations include adding rariblenft.net to network‑level deny lists, configuring web‑proxy rules to block any HTTP traffic to the associated IP range, and monitoring DNS logs for queries to the Cloudflare name servers linked to the domain. Because the site is no longer reachable, content‑level analysis cannot be performed; the exact phishing page or credential‑stealing mechanisms remain unknown. Continuous surveillance of newly registered domains that resolve to Cloudflare IPs and mimic the “Rarible” title is advised to pre‑empt similar future campaigns.