rainbowaz[.]com

This domain, rainbowaz.com, is flagged as a generic phishing site designed to harvest cryptocurrency wallet credentials or related sensitive financial data. Analysis of the page title, 编组 21, suggests a possible connection to Chinese-language threat actors or campaigns targeting users in the APAC region, though no specific brand impersonation is confirmed. The lack of identifiable drainer kit signatures indicates a custom or obfuscated phishing framework, likely tailored to bypass basic detection mechanisms. Infrastructure analysis reveals the domain was registered on July 22, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335), which is commonly exploited to mask malicious infrastructure. The domain is flagged by 12 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. It appears on at least one security blocklist and was proactively blocked by enterprise phishing detection systems. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy while failing to validate the site’s authenticity. As of the latest assessment, rainbowaz.com has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, the underlying threat remains elevated due to the domain’s recent creation date, use of bulletproof infrastructure, and historical targeting of cryptocurrency users. Organizations are advised to monitor for related domains registered under the same registrar or resolving to identical IP ranges. Network defenders should update blocklists to include this domain and its associated indicators, while users should verify wallet addresses and avoid entering credentials on unverified platforms.