rainbowairdrops[.]xyz

The domain rainbowairdrops.xyz is a phishing site engaged in brand impersonation targeting the Rainbow cryptocurrency platform. It presents itself as a legitimate airdrop campaign under the name 'Rainbow Airdrop | RNBW Token' to deceive users into disclosing sensitive information or interacting with fraudulent smart contracts. No crypto drainer kit was identified, but the site operates as an airdrop scam. As of the latest verification, rainbowairdrops.xyz has been taken offline.

Technical analysis reveals that rainbowairdrops.xyz was flagged by 4 of 95 security vendors on VirusTotal, including alphaMountain.ai, CRDF, and CyRadar. The domain appears on one security blocklist, PhishDestroy, and holds a Gridinsoft trust score of 0 out of 100. It was registered through Ultahost, Inc. on October 14, 2025, and resolves to the IP address 45.12.2.67, hosted by Virtual Systems LLC in Ukraine. No SSL certificate was issued for the domain, and its nameservers include ns1.mezoairdrop.xyz and ns1.rainbowairdrops.xyz. Google Safe Browsing did not flag the domain at the time of assessment.

Users who interacted with rainbowairdrops.xyz should revoke any token approvals granted to unknown contracts and transfer funds to a new wallet to mitigate potential risks. If credentials were entered, change passwords immediately and enable two-factor authentication on all related accounts. Monitor financial and cryptocurrency accounts for unauthorized activity. Report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand’s official security team to assist in takedown efforts.