rainbetsplash[.]si

Analysis of the domain rainbetsplash.si indicates it is an active phishing site targeting online betting platforms, though the specific brand impersonated remains unconfirmed as of July 23, 2026. The domain was registered on December 29, 2025, through Openprovider, a registrar frequently utilized for both legitimate and malicious domains. Infrastructure analysis reveals the domain is hosted on Cloudflare nameservers (dina.ns.cloudflare.com and roan.ns.cloudflare.com) and resolves to the IP address 172.67.222.186, an address associated with Cloudflare's proxy service, which may obscure the true origin of the hosting provider. As of the latest scan, 95 security vendors on VirusTotal have evaluated the domain, with no detections reported; however, this absence does not confirm safety, as phishing domains often evade initial detection.

The domain is currently flagged by one security blocklist, PhishDestroy, suggesting preliminary but not yet widespread recognition of its malicious nature. Defenders should note that the domain remains active, with no evidence of takedown or deactivation. The use of Cloudflare nameservers and proxy services complicates attribution and may delay detection by traditional security mechanisms. Given the domain's registration age (over six months) and continued activity, it is likely operational rather than a short-lived campaign.

Organizations are advised to treat this domain as high-risk until further analysis confirms its legitimacy or malicious intent. Blocking access to 172.67.222.186 and monitoring for connections to rainbetsplash.si in network logs is recommended. If the domain is encountered in phishing reports or user-submitted incidents, defenders should correlate additional indicators, such as SSL certificates or HTTP response headers, to identify related infrastructure.