rainbow-app[.]pages[.]dev

The domain rainbow-app.pages.dev is actively targeting users of Rainbow Wallet. It is hosted on Cloudflare Pages with an IP address located in Canada. The domain has yet to be flagged by any antivirus services, as evidenced by its 0 out of 94 detection rate on VirusTotal. This indicates that the domain is in the early stages of its lifecycle, exploiting the typical 24-72 hour gap before antivirus databases are updated with new threat information.

PhishDestroy has already added this domain to its public blocklist, highlighting the proactive measures taken to mitigate the threat. The domain's SSL certificate is issued by Google Trust Services, adding a layer of apparent legitimacy to the phishing operation. It is crucial to note that the domain was registered through Cloudflare Pages, a platform known for its ease of use, which may have facilitated the rapid deployment of this phishing site.

The impersonation of Rainbow Wallet is a clear attempt to deceive users into divulging sensitive information such as login credentials or private keys. The use of a legitimate-sounding page title, "Rainbow Wallet," further aids in this deception. Given the absence of VirusTotal detections, this domain represents a fresh threat, emphasizing the importance of timely threat intelligence and rapid response measures. As the domain remains active, it is essential to recognize the potential risk it poses to Rainbow Wallet users.