rainbow-wallet[.]com[.]mx

rainbow-wallet.com.mx was registered on 2026-07-10 through Registrar.eu and is currently pointing to the IPv4 address 209.74.82.247. The domain is served by three DNSPod name servers (a.dnspod.com, b.dnspod.com, c.dnspod.com). Internal classification tags the domain as a crypto‑drainer, and the risk level remains under investigation while the indicator status is active. No public content has been retrieved, and there is no evidence of a specific payload or payment‑processing page. The short age of the domain, combined with the use of a reputable DNS provider, suggests a deliberately staged infrastructure rather than a compromised legacy site. Analysts should monitor DNS resolution for changes, query the IP for additional services, and add the domain to blocklists used by perimeter defenses. Network sensors should flag outbound connections to 209.74.82.247, especially any traffic attempting to interact with cryptocurrency wallets. Because the domain’s activity window is narrow, retrospective logs from before 2026‑07‑10 are unlikely to contain relevant events, but continuous logging is advised to capture any future malicious transactions. Further investigation is required to determine whether the site hosts a phishing front‑end, a malicious downloader, or a command‑and‑control endpoint. Until such details are uncovered, precautionary blocking and heightened alerting are recommended.