coiniist-rainbow.xyz

coiniist-rainbow.xyz was created on 11 December 2025 and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain resolves to IP 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented, indicating that the site operates over plain HTTP. The authoritative nameservers are kia.ns.cloudflare.com and mario.ns.cloudflare.com. The site presented the page title “Rainbow Token Sale – CoinList”, suggesting an attempt to impersonate a legitimate token offering. Intelligence indicates the campaign uses the Angel Drainer kit and the broader Token Presale phishing kit, both commonly employed to harvest private keys and redirect cryptocurrency assets.

The brand target is listed as “across”, and the overall scam type is classified as a crypto drainer. Detection data show that the domain appears on a single security blocklist and is referenced in one AlienVault OTX pulse. Google Safe Browsing categorises the URL as social engineering. VirusTotal scans returned 16 positive detections out of 95 submitted security vendors. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. PhishDestroy has already blocked the domain, and the current operational status is offline.

While the page content has not been publicly disclosed, the combination of the page title, kit usage, and detection signatures strongly indicates a credential‑stealing operation aimed at cryptocurrency wallets. The lack of an SSL certificate and reliance on Cloudflare DNS further align with typical infrastructure choices for fast‑deployment phishing campaigns. Uncertainty remains regarding the full scope of victim outreach and whether additional infrastructure (e.g., command‑and‑control servers) is associated with the same IP range.