rainbow-proposal[.]xyz

PhishDestroy identifies rainbow-proposal.xyz as a malicious domain operating under an active crypto drainer campaign. Current risk status remains under investigation as analysts assess the scope of impersonation tactics. Threat actors frequently leverage decoy proposals to trick victims into connecting crypto wallets, resulting in fund misappropriation. rainbow-proposal.xyz resolves to IP 172.67.192.73 and operates under a Let’s Encrypt SSL certificate issued at domain creation on May 10, 2026. As of this assessment, the domain shows 0 detections among 95 VirusTotal vendors, indicating minimal network coverage, while being registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. No public blocklist entries are currently recorded, suggesting recent activation and low historical visibility. Domain trust and reputation metrics stand at critically low levels due to its association with newly observed malicious infrastructure. Authorities strongly advise immediate network blocking of rainbow-proposal.xyz and routing policies that deny access to 172.67.192.73. Organizations are urged to inspect endpoints for unauthorized cryptocurrency wallet connections, scan for traffic to this domain, and audit SSL certificates for anomalies. Users are cautioned against engaging with any proposal content on this domain and to report incidents through standardized fraud channels to aid ongoing investigations.