rainbetnederland[.]org

Analysis of rainbetnederland.org indicates an active generic phishing campaign targeting users of the Rainbet betting service. The site presents a page title reading "Rainbet Nederland | 250% welkomstbonus tot €2.100 + 60 spins," suggesting a lure based on promotional offers. Infrastructure details show the domain resolves to IP address 185.111.111.155, which is registered to DataCamp Limited in Germany. DNS is hosted on Cloudflare, using the authoritative nameservers amy.ns.cloudflare.com and rodney.ns.cloudflare.com. Registration was performed through Dynadot Inc. The site employs a Let’s Encrypt certificate (YE1) and returns HTTP status 200, confirming the web server is reachable. Threat intelligence flags include presence on three security blocklists and detection by PhishDestroy, MetaMask, and SEAL. AlienVault OTX reports the domain in two separate threat pulses, reinforcing its malicious reputation. VirusTotal analysis records a single positive detection out of ninety‑one scanners. While the exact phishing landing page content has not been captured, the combination of blocklist listings, blocklist vendor detections, and the promotional page title strongly suggests a credential‑harvesting or account‑takeover attempt. Defenders should block the domain and its associated IP at perimeter firewalls, update web filtering and email security policies to deny traffic to rainbetnederland.org, and monitor for any related indicator of compromise in logs. Continuous monitoring of the Cloudflare nameservers for changes is advised, as the infrastructure could be leveraged for additional malicious sites.