rainbetswitzerland[.]ch

On July 22, 2026, the domain rainbetswitzerland.ch is confirmed to be active and associated with high-risk generic phishing infrastructure. The domain has been explicitly blocked by multiple security providers, including PhishDestroy, MetaMask, and SEAL. This coordinated action, alongside its listing on three security blocklists, provides substantial evidence that rainbetswitzerland.ch is being used for malicious purposes targeting internet users. Current DNS records show the domain is utilizing Openprovider's nameservers (ns1.openprovider.nl, ns2.openprovider.be, ns3.openprovider.eu), and it resolves to IP address 103.217.252.135.

This hosting detail may assist defenders tracking associated infrastructure or correlating with other known threats. At the time of review, the exact content or tactics utilized on the domain are not yet analyzed; there is no page title or brand evidence linking this site to a specific phishing kit or impersonation campaign. VirusTotal indicates that the domain has been processed by 95 vendors, with none currently flagging it; however, as the absence of detections does not equate to safety, defenders should treat the domain as hostile based on blocklist and industry reporting. The presence on multiple blocklists and coordinated vendor blocks indicate the domain is likely involved in active phishing campaigns.

Security teams are advised to enforce network-level blocking of rainbetswitzerland.ch and its associated IP address, closely monitor for related infrastructure, and update detection signatures to ensure coverage. Continued investigation is warranted, and defenders should not rely on the lack of mainstream antivirus detections when determining policy or response. Any internal sightings of related traffic should be reviewed as potential compromise attempts.