rainbow-app[.]net

PhishDestroy first observed rainbow-app.net on Mar 7, 2026. The captured page title is “Rainbow | Fun, powerful, and secure crypto wallets”. Stored page analysis classifies the content as generic phishing. Current evidence score: 95/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, DNS security resolvers, and URLQuery. VirusTotal recorded 11 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, CyRadar, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Sophos on Jul 27, 2026 at 02:37 UTC. DNS security checks returned 4 blocking results across 14 tested policies: Brand Rainbow, Control D Adblock, Control D Family, Control D Malware; no observation timestamp was retained. URLQuery recorded 1 detection on Mar 7, 2026 at 01:55 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 06:20 UTC. On Mar 7, 2026 at 03:54 UTC, Google Safe Browsing returned no flag; PhishStats returned no feed match. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:49 UTC.

HTTP 200 was recorded on Aug 7, 2026 at 22:21 UTC. Registration records for the domain list PDR Ltd. d/b/a PublicDomainRegistry.com as the registrar and Mar 7, 2026 as the creation date. Registration and first observation occurred on the same UTC date. At collection time, the hostname resolved to 199.188.200.148 on AS22612 (Namecheap, Inc.). The recorded endpoint location is Phoenix, US. The stored server header is LiteSpeed. DOM analysis on Jul 9, 2026 at 02:20 UTC returned 56/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. TLS metadata lists Sectigo Limited / Sectigo Public Server Authentication CA DV R36 as the certificate issuer with validity through Feb 10, 2027; checked Mar 15, 2026 at 05:57 UTC.

The content indicators and 3 positive source findings support the current generic phishing classification.