rainbow-ethereum[.]pages[.]dev

This domain, rainbow-ethereum.pages.dev, is identified as a brand impersonation threat specifically targeting Ethereum users through a fraudulent Rainbow Wallet interface. The site is designed to deceive visitors into believing they are interacting with a legitimate cryptocurrency wallet, likely to harvest credentials, private keys, or facilitate unauthorized transactions. Given the domain's focus on Ethereum, the primary risk involves financial loss through credential theft or direct asset drainage, a tactic commonly associated with crypto wallet phishing schemes. Analysis indicates the domain was registered through Cloudflare, Inc., with a creation date of February 25, 2026, suggesting a recently established infrastructure for malicious purposes. The domain resolves to the IP address 172.66.47.151 and is flagged by 2 out of 95 security vendors on VirusTotal. Additionally, it appears on 4 security blocklists and is actively blocked by multiple security tools, including MetaMask and ScamSniffer. The SSL certificate is issued by Google Trust Services, which, while legitimate, does not mitigate the domain's malicious intent. Users who have visited rainbow-ethereum.pages.dev should immediately cease all interaction with the site. If credentials or private keys were entered, affected parties must transfer assets to a new, secure wallet and revoke any connected permissions or sessions. Monitor transaction histories for unauthorized activity and consider reporting the incident to relevant blockchain security resources. Given the domain's current offline status, users should remain vigilant for similar impersonation attempts, particularly those mimicking well-known crypto wallet brands.