rnbw-coiniist[.]co

This domain is flagged as an elevated-risk brand impersonation site designed to deceive users of the Across protocol. Analysis indicates the infrastructure was specifically crafted to mimic legitimate token sales, likely to facilitate unauthorized asset transfers or credential harvesting under the guise of a "Rainbow Token Sale - CoinList" campaign. The threat type is classified as crypto brand impersonation, with the potential to enable wallet-draining attacks or phishing for sensitive authentication details. Infrastructure analysis reveals the domain rnbw-coiniist.co was registered on December 10, 2025, through Web Commerce Communications Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.160.120, hosted on AS13335 (Cloudflare, Inc.), a network commonly leveraged to obscure malicious activity behind content delivery networks. The domain lacks an SSL certificate, further reducing its legitimacy. Security vendors on VirusTotal flagged the domain at a ratio of 11/95, while it appears on two blocklists (PhishDestroy and ScamSniffer), reinforcing its malicious classification. No historical trust scores or benign associations were identified during analysis. Mitigation steps for this threat type include immediate blacklisting of the domain and IP across all organizational security controls. Users who interacted with the site should revoke any wallet permissions granted during the session and monitor transaction histories for unauthorized activity. Network administrators are advised to implement DNS sinkholing for the domain and its associated IP to prevent further access. Given the domain's current offline status, continuous monitoring for re-emergence or similar impersonation attempts targeting Across or related DeFi platforms is recommended. Organizations should also educate users on verifying token sale legitimacy through official channels before engaging with any promotional campaigns.