rnbw-rainbow[.]com

Analysis indicates that the domain rnbw-rainbow.com was registered through Dynadot LLC on 4 December 2025 and is currently taken offline, returning an HTTP 404 status. The site was configured to use Cloudflare’s DNS service, as evidenced by the authoritative nameservers alexa.ns.cloudflare.com and randall.ns.cloudflare.com, and the IP address 104.21.89.36 resolves to the Cloudflare network (AS13335) located in the United States. The presence of Cloudflare’s HTTP/3 support and a Google Trust Services / WE1 TLS certificate suggests that the operator leveraged reputable infrastructure to increase perceived legitimacy. The page title observed during the brief crawl was "Prime Budgeting Experts," and the domain was catalogued as a wallet/seed phishing campaign targeting Curve users.

This classification aligns with the single AlienVault OTX pulse that references the domain, and the fact that PhishDestroy has already added it to its blocklist. VirusTotal scans show five of ninety‑five security vendors flagging the domain, reinforcing the malicious assessment. The domain appears on one additional security blocklist, confirming that at least some protective services have recognized it as hostile. Uncertainty remains regarding the specific payload or phishing page content, as the site is no longer reachable and no further forensic artifacts have been published.

Defenders should continue to block the domain at perimeter filters, update DNS‑based deny lists with the observed IP and nameserver information, and monitor for any re‑use of the infrastructure in new campaigns. Because the domain employed a valid TLS certificate, traditional SSL inspection may be required to uncover hidden redirects if the site resurfaces. Continuous correlation of threat intel feeds, especially OTX and vendor‑specific detections, will help identify any recurrence of the same seed‑phishing kit. In summary, the available evidence classifies rnbw-rainbow.