rainbow-swap-v2[.]pages[.]dev

The domain rainbow-swap-v2.pages.dev is currently identified as an active credential theft threat targeting users involved in cryptocurrency transactions. The specific threat involves attempts to steal user credentials, potentially leading to unauthorized access and loss of funds. At present, the domain’s risk level remains under investigation as researchers continue to monitor its activity and potential impact.

Technical analysis shows that rainbow-swap-v2.pages.dev resolves to IP address 172.66.44.174 and is registered through Cloudflare, Inc. The domain uses an SSL certificate issued by Google Trust Services, which may lend it a veneer of legitimacy to unsuspecting users. According to VirusTotal data, it is not flagged by any of the 95 scanning vendors, registering 0 detections at this time. No creation date or blocklist counts are currently available. This combination of factors suggests the domain is newly active or designed to evade detection by mainstream security tools.

Given the domain’s active status and specific use for credential theft, users should avoid interacting with it, especially refraining from entering any login or wallet information. Security teams should consider blocking the IP 172.66.44.174 and monitor for any related domains or phishing campaigns using Cloudflare infrastructure. Continued vigilance and updating of threat intelligence feeds are recommended to capture any future detection updates or user reports. Immediate preventive action can mitigate potential harm as investigations proceed.