# Phishing sites impersonating Rainbow PhishDestroy has recorded 26 phishing domains impersonating Rainbow since 2025-08-08, 7 of them in the last 30 days. The most used registrars are Dynadot and PublicDomainRegistry.com; the most common TLDs are .shop and .com. Open Rainbow only from its official app or a saved bookmark. 26Domains, all time 7Last 30 days 16Online at last check 5Confirmed takedowns ## New domains in the last 90 days Rainbow phishing domains detected per day: 9 from 2026-07-25 to 2026-10-22; peak 2. ## How to tell a fake Rainbow site Words most often added to the brand in reported domains: rainbows, claim, swap, apostasbetanovip, rainbowdefiai, rainbowairdrops, pumppilot, dailyworkiidpro, rexeu, luckyroom. - Type the address yourself or use a bookmark; phishing links for Rainbow arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - Rainbow will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest Rainbow phishing domains The 26 most recently detected domains impersonating Rainbow Domain | First detected | Status at last check | Registrar | [bm25.shop](https://phishdestroy.io/domain/bm25.shop/) | 2026-10-18 | Online | Dynadot | [bloxystorestore.shop](https://phishdestroy.io/domain/bloxystorestore.shop/) | 2026-10-18 | Online | Dynadot | [bladeco.shop](https://phishdestroy.io/domain/bladeco.shop/) | 2026-10-17 | Online | Dynadot | [birdinhandco.shop](https://phishdestroy.io/domain/birdinhandco.shop/) | 2026-10-16 | Online | Dynadot | [billyfootwearonline.shop](https://phishdestroy.io/domain/billyfootwearonline.shop/) | 2026-10-16 | Online | Dynadot | [benvibe.shop](https://phishdestroy.io/domain/benvibe.shop/) | 2026-10-13 | Online | Dynadot | [backtotherootsgear.shop](https://phishdestroy.io/domain/backtotherootsgear.shop/) | 2026-10-10 | Online | Dynadot | [adleystore.shop](https://phishdestroy.io/domain/adleystore.shop/) | 2026-09-09 | Online | Dynadot | [adleybaby.shop](https://phishdestroy.io/domain/adleybaby.shop/) | 2026-09-09 | Offline | Dynadot | [rainbow-proposal.xyz](https://phishdestroy.io/domain/rainbow-proposal.xyz/) | 2026-05-11 | Unknown | NICENIC | [rb-417.com](https://phishdestroy.io/domain/rb-417.com/) | 2026-04-24 | Online | Trustname.com | [rainbow-recovery.org](https://phishdestroy.io/domain/rainbow-recovery.org/) | 2026-03-29 | Online | Tucows Domains | [rainbowflsh.net](https://phishdestroy.io/domain/rainbowflsh.net/) | 2026-02-26 | Taken down | NiceNIC | [sammybrainrots.com](https://phishdestroy.io/domain/sammybrainrots.com/) | 2026-02-13 | Online | NiceNIC | [claim.raimbow.xyz](https://phishdestroy.io/domain/claim.raimbow.xyz/) | 2026-02-07 | Offline | PublicDomainRegistry.com | [luckyroom.net](https://phishdestroy.io/domain/luckyroom.net/) | 2026-02-01 | Offline | REGRU-RU | [rexeu.com](https://phishdestroy.io/domain/rexeu.com/) | 2026-02-01 | Online | Web Commerce Communications | [claim-rainbow.net](https://phishdestroy.io/domain/claim-rainbow.net/) | 2026-01-24 | Taken down | PublicDomainRegistry.com | [dailyworkiidpro.com](https://phishdestroy.io/domain/dailyworkiidpro.com/) | 2026-01-03 | Taken down | Gname.com | [rainbows.run](https://phishdestroy.io/domain/rainbows.run/) | 2025-12-20 | Taken down | PublicDomainRegistry.com | [rainbows.bet](https://phishdestroy.io/domain/rainbows.bet/) | 2025-12-18 | Taken down | PublicDomainRegistry.com | [pumppilot.fun](https://phishdestroy.io/domain/pumppilot.fun/) | 2025-12-04 | Offline | NameCheap | [rainbowairdrops.xyz](https://phishdestroy.io/domain/rainbowairdrops.xyz/) | 2025-10-15 | Online | Ultahost | [rainbowdefiai.net](https://phishdestroy.io/domain/rainbowdefiai.net/) | 2025-09-02 | Offline | Gname.com | [apostasbetanovip.info](https://phishdestroy.io/domain/apostasbetanovip.info/) | 2025-08-16 | Offline | Dynadot | [rainbow-swap.com](https://phishdestroy.io/domain/rainbow-swap.com/) | 2025-08-08 | Unknown | NiceNIC | [All 26 Rainbow reports](https://phishdestroy.io/domain/?brand=Rainbow) ## Where they are registered and hosted ### Registrars - [Dynadot](https://phishdestroy.io/registrar/dynadot/)9 - [PublicDomainRegistry.com](https://phishdestroy.io/registrar/publicdomainregistry-pdr/)4 - [NiceNIC](https://phishdestroy.io/registrar/nicenic/)3 - [Gname.com](https://phishdestroy.io/registrar/name-com/)2 - [Dynadot](https://phishdestroy.io/registrar/dynadot/)1 - [Ultahost](https://phishdestroy.io/registrar/ultahost/)1 - [NameCheap](https://phishdestroy.io/registrar/namecheap/)1 - [Web Commerce Communications](https://phishdestroy.io/registrar/webnic/)1 ### Top-level domains - [.shop](https://phishdestroy.io/tld/shop/)9 - [.com](https://phishdestroy.io/tld/com/)5 - [.net](https://phishdestroy.io/tld/net/)4 - [.xyz](https://phishdestroy.io/tld/xyz/)3 - [.info](https://phishdestroy.io/tld/info/)1 - [.fun](https://phishdestroy.io/tld/fun/)1 - [.bet](https://phishdestroy.io/tld/bet/)1 - [.run](https://phishdestroy.io/tld/run/)1 ### Hosting networks - CLOUDFLARENET, US6 - Malakmadze Web LLC6 - CLOUDFLARENET - Cloudflare, Inc., US3 - Cloudflare, Inc.3 - malakmadze Malakmadze Web LLC, GE2 - DDOS-GUARD DDOS-GUARD LTD, RU1 - AS-COLOCROSSING, US1 - YURTEH-AS Virtual Systems LLC, UA1 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/) - [Seed phrase phishing](https://phishdestroy.io/glossary/seed-phrase-phishing/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Rainbow; share of all PhishDestroy reports: 0.01%. Canonical: https://phishdestroy.io/brand/rainbow/