rain-bet[.]xyz

Analysis of rain-bet.xyz indicates an active generic phishing operation. The domain was registered on April 09 2026 through DYNADOT LLC and is hosted on the IP address 188.114.96.3, which is served by Cloudflare name servers adi.ns.cloudflare.com and burt.ns.cloudflare.com. VirusTotal has processed the domain with 95 scanning engines and reported no detections; however, the lack of detections is not evidence of legitimacy. The site is currently listed on three external security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the classification as malicious.

The threat is identified as generic phishing, and the risk level is marked high. At present no public page title or SSL certificate information has been disclosed, so the content served by the site cannot be verified. The lack of visible brand references in the available metadata means the phishing campaign likely employs a generic lure rather than targeting a specific brand. Because the infrastructure relies on Cloudflare's DNS service, rapid takedown may be limited, but DNS‑level filtering remains effective.

Security teams should also monitor for any future changes to the DNS records or additional IP addresses that might be added to the hosting pool. Integration of the domain into endpoint protection and web gateway blocklists will help reduce exposure. Ongoing observation of traffic to 188.114.96.3 is recommended to detect possible command‑and‑control or data exfiltration activity associated with the phishing campaign.