rainbowspinslogin-co-uk[.]pages[.]dev

PhishDestroy identifies rainbowspinslogin-co-uk.pages.dev as an active credential phishing domain designed to mimic Rainbow Spins’ login interface. This domain employs a deceptive .pages.dev subdomain structure to lend false legitimacy to its fake login portal, likely aiming to harvest user credentials for subsequent account takeovers or credential stuffing attacks. The infrastructure hosting this phishing page resolves to Cloudflare IP 172.66.47.173, a known anonymizing service frequently abused by threat actors to obfuscate malicious infrastructure. At present, no evidence suggests the deployment of a crypto drainer or advanced JavaScript-based credential theft kit, but the site’s layout and branding closely replicate legitimate Rainbow Spins login flows, increasing the risk of successful deception.

Technical analysis reveals this domain remains undetected by 95 VirusTotal scanners as of the latest scan, indicating a low detection rate and prolonged exposure window. Registered through Cloudflare, Inc., the domain leverages a Google Trust Services SSL certificate to enhance perceived trustworthiness. The domain’s age and creation timeline are still under investigation, but its integration with Cloudflare Pages suggests rapid deployment—a common tactic among opportunistic phishing operators. Notably, this domain has not been flagged by Google Safe Browsing (GSB) or major threat intelligence blocklists, leaving users and organizations vulnerable to unmitigated exposure. The absence of prior detections underscores the need for proactive monitoring and real-time threat intelligence sharing.

This domain is currently classified as active with an under-investigation risk level, indicating ongoing analysis by threat intelligence teams. PhishDestroy has flagged this domain for immediate review and recommends users avoid interacting with any login prompts associated with rainbowspinslogin-co-uk.pages.dev. Organizations are advised to update browser blocklists, deploy DNS filtering, and educate users on verifying domain authenticity via PhishDestroy’s verification tools. While the immediate risk remains elevated due to low detection rates, the lack of a confirmed drainer kit or data exfiltration endpoint tempers the severity—though continued monitoring is essential. Users who suspect exposure should reset passwords immediately and enable multi-factor authentication on all Rainbow Spins accounts.