rainbetcasino-ch[.]eu[.]com

rainbetcasino-ch.eu.com is currently active and has been classified as a generic phishing site. The domain resolves to the IPv4 address 172.67.191.224 and is served through Cloudflare's DNS infrastructure, using the authoritative name servers carmelo.ns.cloudflare.com and summer.ns.cloudflare.com. Cloudflare's edge network conceals the origin server, a pattern frequently observed in malicious operations that aim to increase resilience against takedown attempts.

The domain appears on three security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, indicating that multiple independent threat‑intelligence feeds have identified it as hostile. VirusTotal analysis reports that three of ninety‑one scanned security vendors flagged the domain as malicious, providing a modest but notable detection rate that reinforces the high‑risk assessment. No publicly available intelligence such as OTX tags, SSL certificate details, HTTP status codes, or page title has been released, so the exact content delivered by the site remains unverified.

Defenders should add rainbetcasino-ch.eu.com to DNS and URL filtering policies, block resolution to 172.67.191.224 for this FQDN, and monitor for any new indicators that may emerge from subsequent scans. Because the hosting relies on Cloudflare, any takedown request should be directed to Cloudflare’s abuse contact channels. The combination of active status, blocklist listings, vendor detections, and the obscured hosting environment supports a high‑confidence determination that the domain is being used for phishing activities.