rainbet-casino[.]cz

The domain rainbet-casino.cz was registered on 16 March 2026 through the registrar REG‑GRANSY and is currently resolved to the IPv4 address 188.114.97.3. The authoritative name servers are brianna.ns.cloudflare.com and julio.ns.cloudflare.com, indicating that the hosting infrastructure is provided by Cloudflare’s edge network. As of the report date 22 July 2026 the domain remains active and appears on three public security blocklists, where it has been flagged by the PhishDestroy, MetaMask and SEAL blocklist operators. VirusTotal scans show that three out of ninety‑five AV engines have raised a detection for the domain, reinforcing the suspicion of malicious use. The limited telemetry available does not include a page title, SSL certificate details, HTTP response codes, or any explicit indication of the brand being spoofed.

Consequently the precise phishing lure – such as a login portal, payment gateway, or credential‑harvesting form – cannot be confirmed at this time. Nonetheless the classification of “generic phishing” provided in the intelligence feed aligns with the observed blocklist activity and the modest number of vendor detections. The high risk level assigned to the domain reflects the combination of its recent creation, active status, and presence on multiple reputable blocklists. The use of Cloudflare’s DNS may provide the attacker with rapid DNS updates and DDoS mitigation, complicating takedown efforts. No TLS certificate fingerprint has been published, so the presence of HTTPS cannot be verified, but the IP address belongs to a range frequently used for short‑lived phishing campaigns.

Analysts should also query passive DNS feeds to detect any additional hostnames that resolve to the same IP, as threat actors often reuse infrastructure across multiple campaigns. Defenders should treat rainbet-casino.cz as a high‑risk indicator.