# PhishDestroy domain threat record: aus-rainbets.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/aus-rainbets.com/
Machine-readable companion: https://phishdestroy.io/domain/aus-rainbets.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-10-16 14:24:04 UTC
- Last availability or vendor check: 2026-10-21 01:24:55 UTC
- Stored record updated: 2026-10-22 14:20:59 UTC
- VirusTotal detections in the stored snapshot: 13/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: across

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: URL Solutions, Inc.
- Last stored HTTP status: 403
- Registration date (registry RDAP, aus-rainbets.com): 2026-10-12 16:25:05 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a14518-724b-77ca-b719-7e21e450f4ae/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/aus-rainbets.com
- Certificate Transparency search: https://crt.sh/?q=%25.aus-rainbets.com
- Web Archive lookup: https://web.archive.org/web/*/https://aus-rainbets.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
aus-rainbets.com presents itself as "Rainbet Australia | Online Casino, Pokies". It borrows the name of the Rainbet crypto casino and adds a country prefix to appeal to Australian players. PhishDestroy classifies it as a fraudulent gambling site and first flagged it on 2026-10-16. As of 2026-10-19 the site was still online and serving its casino content.

How the scam works
Sites like this copy the look and branding of a known casino so that players searching for a local version of Rainbet trust it enough to sign up and deposit. Money sent as crypto or by card goes straight to whoever runs the clone, not to Rainbet. Winnings shown on screen exist only to encourage bigger deposits. When a player tries to withdraw, the payout typically stalls behind verification hurdles, extra "fees" or account freezes, and the deposited funds are lost.

Evidence
Only one of 92 VirusTotal engines, Fortinet, flagged the domain at the 2026-10-16 check, so most antivirus-based filters will not stop a visit. The stronger signals come from crypto-focused blocklists: MetaMask and SEAL both list it alongside PhishDestroy, so MetaMask users should see a warning. Spamhaus carries the domain in its DBL as a spam domain. Four AlienVault OTX threat pulses reference it, which shows other researchers have tracked it independently.

Infrastructure
The domain was registered on 2026-10-12 through URL Solutions, Inc., just four days before PhishDestroy detected it. That short gap fits a freshly launched clone pushed into promotion right away. The site sits behind Cloudflare, with the network located in Canada, so the real origin server is hidden from view.

What to do
Do not deposit anything on aus-rainbets.com, and do not pay any "withdrawal", "tax" or "verification" fee it demands, because those payments are lost as well. If you already deposited, record your transaction IDs and account details. Report card payments to your bank for a chargeback, and report crypto transfers to the exchange you sent from. If you reused a password from another service when signing up, change it there and enable two-factor authentication. Defenders should block the domain at DNS and proxy level, since antivirus coverage is thin, and watch for similar Rainbet lookalikes with country prefixes.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a14518-724b-77ca-b719-7e21e450f4ae/
VirusTotal report: https://www.virustotal.com/gui/domain/aus-rainbets.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=aus-rainbets.com
Archived copy: https://web.archive.org/web/20261016142225/https://aus-rainbets.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:37:46 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Myr7BxTg/07847bfe9556.png
  Captured: 2026-10-16 14:24:04 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a14518-724b-77ca-b719-7e21e450f4ae.png
  Captured: 2026-10-16 14:24:04 UTC
  Source report: https://urlscan.io/result/01a14518-724b-77ca-b719-7e21e450f4ae/
- URLScan capture 2: https://urlscan.io/screenshots/01a144c9-6eae-75a8-959f-a2fc1405ec30.png
  Captured: 2026-10-16 14:21:50 UTC
  Source report: https://urlscan.io/result/01a14518-724b-77ca-b719-7e21e450f4ae/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/09715f86-199b-4d83-b771-9ed37780ffd1.png
  Captured: 2026-10-16 14:55:32 UTC
  Source report: https://radar.cloudflare.com/scan/09715f86-199b-4d83-b771-9ed37780ffd1
  SHA-256: e79433a86e81b4aa5ecd656feab0a4770d0ecebffa12da402b4842a297738775
- URLQuery: https://screenshots.phishdestroy.io/uq/88be65ec-0bcd-4b56-949c-e8ebf40f7f79.png
  Source report: https://urlquery.net/report/88be65ec-0bcd-4b56-949c-e8ebf40f7f79
  SHA-256: af0097f7fe5a3c390e5ddbb06b4b229b831ec950009e400b78cf5c0541a7b981
- URLScan · 2026-10-15: https://screenshots.phishdestroy.io/us/01a13d39-7112-7168-acb2-3d8e1b1439f2.png
  Captured: 2026-10-15 01:42:24 UTC
  Source report: https://urlscan.io/result/01a13d39-7112-7168-acb2-3d8e1b1439f2/
  SHA-256: c290eda0fca13d915936d923f8a3dad3e01f95828ff820006226d6544aa22149
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a144c9-6eae-75a8-959f-a2fc1405ec30.png
  Captured: 2026-10-16 12:57:00 UTC
  Source report: https://urlscan.io/result/01a144c9-6eae-75a8-959f-a2fc1405ec30/
  SHA-256: 38a33583f1e7290f7dfd2d2402513ba1ad4cd7e1258c778555edcaf877fd5535
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14862-cedb-72ad-8203-09520d3bbd47.png
  Captured: 2026-10-17 05:43:23 UTC
  Source report: https://urlscan.io/result/01a14862-cedb-72ad-8203-09520d3bbd47/
  SHA-256: 38a33583f1e7290f7dfd2d2402513ba1ad4cd7e1258c778555edcaf877fd5535

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:45:39Z",
        "uuid": "01a14518-724b-77ca-b719-7e21e450f4ae",
        "scanned_at": "2026-10-16T14:23:26Z",
        "final_url": "https://aus-rainbets.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://aus-rainbets.com/",
                "from": "http://aus-rainbets.com/",
                "status": 307
            }
        ],
        "ip": "172.67.164.125",
        "domains": [
            "fonts.gstatic.com",
            "static.cloudflareinsights.com",
            "unavatar.io",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.250.207.3",
            "104.16.80.73",
            "172.67.181.251",
            "172.217.25.202",
            "172.67.164.125"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "onebetspin.com",
            "www.gamblinghelponline.org.au",
            "www.betstop.gov.au",
            "www.lifeline.org.au",
            "x.com",
            "aifs.gov.au",
            "www.begambleaware.org",
            "www.relationshipsaustralia.org.au",
            "www.blueprintgaming.com"
        ],
        "social": [
            "https://x.com/isaacmcintyre"
        ],
        "doc_hash": "4b9a15e76154f2bd1ace93ddef2a4ebbfc9f5013f126e5e6529670eeee4499c5",
        "script_hashes": [
            "a084a75482fd5026dd40ea2f0b892762a56b2fd7fcd9861a338d0d84d8729e41"
        ],
        "globals": [
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "aus-rainbets.com",
                "*.aus-rainbets.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "aus-rainbets.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-12T14:42:51Z",
            "valid_from": "2026-10-14T13:42:53Z"
        },
        "domain_age_days": 2,
        "apex_age_days": 2,
        "tls_age_days": 2,
        "tls_valid_days": 90,
        "requests": 24,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:58:52Z",
        "uuid": "09715f86-199b-4d83-b771-9ed37780ffd1",
        "scanned_at": "2026-10-16T14:55:32Z",
        "final_url": "https://aus-rainbets.com/",
        "status": 200,
        "history": [
            {
                "url": "https://aus-rainbets.com/",
                "status": 200
            }
        ],
        "dom_hash": "caa108b64b061fd0021e1b369668a2615cfffd19151bbfb43f48c8e3a0f2ca1d",
        "doc_hash": "e925ddd56a79765034a3bc14fffad76132c5a2a803d0ddfa82dec002b32ed14c",
        "domain_risks": [
            "New Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "aus-rainbets.com",
                "type": "A",
                "value": "104.21.15.213"
            },
            {
                "name": "aus-rainbets.com",
                "type": "A",
                "value": "172.67.164.125"
            },
            {
                "name": "aus-rainbets.com",
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:a47d"
            },
            {
                "name": "aus-rainbets.com",
                "type": "AAAA",
                "value": "2606:4700:3031::6815:fd5"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.15.213",
        "whois": {
            "registrar": "URL Solutions, Inc.",
            "created": "2026-10-12T16:25:05Z",
            "updated": "2026-10-14T14:36:04Z",
            "expires": "2027-10-12T16:25:05Z",
            "nameservers": [
                "izabella.ns.cloudflare.com",
                "robert.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T19:44:50Z",
        "analysis_at": "2026-10-20T02:00:11Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 9,
            "suspicious": 4,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "malware",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "URLQuery": "suspicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "ChainPatrol": "malicious",
            "alphaMountain.ai": "spam",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "spyware and malware",
            "alphaMountain.ai": "Spam, Newly Registered (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "registrar": "URL Solutions, Inc.",
        "created": "2026-10-12T16:25:05Z",
        "expires": "2027-10-12T16:25:05Z",
        "updated": "2026-10-14T14:36:04Z",
        "first_seen": "2026-10-15T14:14:53Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.164.125"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "izabella.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "izabella.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:a47d"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "robert.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.15.213"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::6815:fd5"
            }
        ],
        "dns_at": "2026-10-20T02:00:33Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "aus-rainbets.com",
                "*.aus-rainbets.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "410896419deb610f1383d4b52df7e0b5",
            "sha256": "469b09434ee00c06fda35d1c5966866dce46b92ae5e027c62f1ee86150fe968f",
            "subject": "aus-rainbets.com",
            "valid_to": "2027-01-12T14:42:51Z",
            "valid_from": "2026-10-14T13:42:53Z"
        },
        "whois": {
            "registrar": "URL Solutions, Inc.",
            "registrar_iana_id": "1449",
            "registrar_url": "http://www.pananames.com",
            "created": "2026-10-12T16:25:05Z",
            "updated": "2026-10-14T14:36:04Z",
            "expires": "2027-10-12T16:25:05Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "izabella.ns.cloudflare.com",
                "robert.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "add period"
            ],
            "events": {
                "last changed": "2026-10-12T16:25:06Z",
                "registration": "2026-10-12T16:25:05Z",
                "registrar expiration": "2027-10-12T16:25:05Z",
                "last update of RDAP database": "2026-10-15T14:23:58Z"
            }
        }
    }
}
```