# PhishDestroy domain threat record: rainbe-it.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/rainbe-it.com/
Machine-readable companion: https://phishdestroy.io/domain/rainbe-it.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 07:18:32 UTC
- Last availability or vendor check: 2026-10-25 07:18:32 UTC
- Stored record updated: 2026-10-25 09:00:19 UTC
- VirusTotal detections in the stored snapshot: 8/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: sui

## Stored infrastructure

- Observed IP address: 104.21.80.187
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-08-27 10:44:25 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a171eb-e14a-70b5-97a5-bb02d98ee621/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/rainbe-it.com
- Certificate Transparency search: https://crt.sh/?q=%25.rainbe-it.com
- Web Archive lookup: https://web.archive.org/web/*/https://rainbe-it.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy has added rainbe-it.com to its internal blocklist as a suspicious domain. The recorded page title reads “Rainbet Italia: guida indipendente al brand nel 2026”, presenting the site as an independent guide about the Rainbet brand. The domain was first seen by PhishDestroy on 2026-10-25 and returned an HTTP 200 response at that time.

How the scam works
No specific fraudulent technique was observed on the page; the listing reflects a general risk that a site referencing a known gambling brand could be used for brand impersonation or to lure users to malicious content. Such schemes typically rely on perceived legitimacy of the brand to attract visitors, but no phishing forms, malware delivery, or wallet‑draining behavior were recorded here.

Evidence
VirusTotal scanned the domain on 2026-10-24 and reported eight malicious detections out of 92 engines, with vendors labeling it as phishing or malware. Google Safe Browsing checked on 2026-10-25 and did not flag the site. External blocklists MetaMask and SEAL listed the domain as of 2026-10-25. URLScan’s automated analysis on 2026-10-25 gave the page a malicious score of 93, though its overall verdict was non‑malicious. OTX recorded two pulses mentioning the domain on 2026-10-25, and PhishDestroy’s internal blocklist marks it as suspicious on the same date.

Infrastructure
The domain was registered with Dynadot Inc on 2026-08-27. DNS is served by Cloudflare name servers (dana.ns.cloudflare.com, johnathan.ns.cloudflare.com) without DNSSEC. The recorded IP addresses are 104.21.80.187 and 172.67.153.32, both belonging to Cloudflare, Inc. in Canada, and the TLS certificate issued by Google Trust Services is valid until 2026-11-25.

What to do
Visitors should avoid entering credentials, downloading files, or clicking unknown links on this site; if any credentials were submitted, change them immediately. Security teams should block rainbe-it.com at the perimeter, monitor DNS queries for the domain, and retain the registration and hosting details for further investigation.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a171eb-e14a-70b5-97a5-bb02d98ee621/
Cloudflare Radar report: https://radar.cloudflare.com/scan/7c045876-d967-411d-867f-07bba915ae1f
URLQuery report: https://urlquery.net/report/cf969430-71a0-4657-bcc8-15c340ec611b
Stored capture screenshot: https://i.ibb.co/mC0gZqjd/608d26a1e474.png
Cloudflare Radar screenshot (2026-10-25T07:28:01Z): https://screenshots.phishdestroy.io/cf/7c045876-d967-411d-867f-07bba915ae1f.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/cf969430-71a0-4657-bcc8-15c340ec611b.png
URLScan screenshot (2026-10-25T07:11:55Z): https://screenshots.phishdestroy.io/us/01a171e6-b2b1-70e3-b8e3-6e7b5120ee4c.png
URLScan capture report: https://urlscan.io/result/01a171e6-b2b1-70e3-b8e3-6e7b5120ee4c/
URLScan screenshot (2026-10-25T07:16:01Z): https://screenshots.phishdestroy.io/us/01a171ea-7eb6-7354-aed0-901148542674.png
URLScan capture report: https://urlscan.io/result/01a171ea-7eb6-7354-aed0-901148542674/
VirusTotal report: https://www.virustotal.com/gui/domain/rainbe-it.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rainbe-it.com
Archived copy: https://web.archive.org/web/20261025072044/https://rainbe-it.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 07:54:18 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/mC0gZqjd/608d26a1e474.png
  Captured: 2026-10-25 07:18:32 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a171eb-e14a-70b5-97a5-bb02d98ee621.png
  Captured: 2026-10-25 07:18:32 UTC
  Source report: https://urlscan.io/result/01a171eb-e14a-70b5-97a5-bb02d98ee621/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7c045876-d967-411d-867f-07bba915ae1f.png
  Captured: 2026-10-25 07:28:01 UTC
  Source report: https://radar.cloudflare.com/scan/7c045876-d967-411d-867f-07bba915ae1f
  SHA-256: 468633a804949fe15942df9645f93a02b9fb48daf81f73d82ec930d45bc045af
- URLQuery: https://screenshots.phishdestroy.io/uq/cf969430-71a0-4657-bcc8-15c340ec611b.png
  Source report: https://urlquery.net/report/cf969430-71a0-4657-bcc8-15c340ec611b
  SHA-256: 8796490d2ce9bf203774dc82ceb1528fd3d0fd7ffb006f453d5d51357d4865b5
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a171e6-b2b1-70e3-b8e3-6e7b5120ee4c.png
  Captured: 2026-10-25 07:11:55 UTC
  Source report: https://urlscan.io/result/01a171e6-b2b1-70e3-b8e3-6e7b5120ee4c/
  SHA-256: 0c228ba6fbb2a05fc11fa39aad209b11e1123d13b2de8abc8258917b838cade8
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a171ea-7eb6-7354-aed0-901148542674.png
  Captured: 2026-10-25 07:16:01 UTC
  Source report: https://urlscan.io/result/01a171ea-7eb6-7354-aed0-901148542674/
  SHA-256: 0c228ba6fbb2a05fc11fa39aad209b11e1123d13b2de8abc8258917b838cade8

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T07:29:09Z",
        "uuid": "01a171eb-e14a-70b5-97a5-bb02d98ee621",
        "scanned_at": "2026-10-25T07:17:34Z",
        "final_url": "https://rainbe-it.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://rainbe-it.com/",
                "from": "http://rainbe-it.com/",
                "status": 307
            }
        ],
        "ip": "104.21.80.187",
        "domains": [
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.16.80.73",
            "104.21.80.187"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.adm.gov.it",
            "rainbet.com",
            "help.rainbet.com"
        ],
        "doc_hash": "7feff45b9ba46af233b3bbfff6f9d15c84ecf4aac6a3ed5327397d0e5cae69e6",
        "script_hashes": [
            "f3f76ce096cfd3c95da3af589af4a845d2c3dccf153701eaaec17c0f005f1e47"
        ],
        "globals": [
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "rainbe-it.com",
                "*.rainbe-it.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "rainbe-it.com",
            "protocol": "QUIC",
            "valid_to": "2026-11-25T12:49:24Z",
            "valid_from": "2026-08-27T11:50:55Z"
        },
        "domain_age_days": 58,
        "apex_age_days": 58,
        "tls_age_days": 58,
        "tls_valid_days": 90,
        "requests": 10,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 93,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T07:29:11Z",
        "uuid": "7c045876-d967-411d-867f-07bba915ae1f",
        "scanned_at": "2026-10-25T07:28:01Z",
        "final_url": "https://rainbe-it.com/",
        "status": 200,
        "history": [
            {
                "url": "https://rainbe-it.com/",
                "status": 200
            }
        ],
        "dom_hash": "575c270663c50e05857e48d6598b356ef96bb373f2460b1e99fb02ebfbb4cc02",
        "doc_hash": "7feff45b9ba46af233b3bbfff6f9d15c84ecf4aac6a3ed5327397d0e5cae69e6",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "rainbe-it.com",
                "type": "A",
                "value": "104.21.80.187"
            },
            {
                "name": "rainbe-it.com",
                "type": "A",
                "value": "172.67.153.32"
            },
            {
                "name": "rainbe-it.com",
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:9920"
            },
            {
                "name": "rainbe-it.com",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:50bb"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.80.187",
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-08-27T12:44:25Z",
            "updated": "2026-08-27T12:48:55Z",
            "expires": "2027-08-27T12:44:25Z",
            "nameservers": [
                "dana.ns.cloudflare.com",
                "johnathan.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T07:52:09Z",
        "analysis_at": "2026-10-24T12:04:33Z",
        "stats": {
            "timeout": 0,
            "harmless": 50,
            "malicious": 8,
            "suspicious": 0,
            "undetected": 34
        },
        "detections": {
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "BitDefender": "phishing",
            "ChainPatrol": "malicious",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Gambling, Malicious (alphaMountain.ai)"
        },
        "registrar": "Dynadot Inc",
        "created": "2026-08-27T12:44:25Z",
        "expires": "2027-08-27T12:44:25Z",
        "updated": "2026-08-27T12:48:55Z",
        "first_seen": "2026-08-27T13:15:39Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "johnathan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:50bb"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.80.187"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dana.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:9920"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.153.32"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "dana.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-24T12:53:06Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "rainbe-it.com",
                "*.rainbe-it.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "f48462ff38b66673139f25808a30966d",
            "sha256": "3a3b157bb61b67f4eb0dae52f569864a205eb170faccb0b9c785ff5143d55c3a",
            "subject": "rainbe-it.com",
            "valid_to": "2026-11-25T12:49:24Z",
            "valid_from": "2026-08-27T11:50:55Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-08-27T12:44:25Z",
            "updated": "2026-08-27T12:48:55Z",
            "expires": "2027-08-27T12:44:25Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "dana.ns.cloudflare.com",
                "johnathan.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-08-27T12:44:25Z",
                "last changed": "2026-08-27T12:48:56Z",
                "registration": "2026-08-27T12:44:25Z",
                "registrar expiration": "2027-08-27T12:44:25Z",
                "last update of RDAP database": "2026-10-23T11:09:12Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T07:29:22Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "rainbe-it.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-25T07:20:44Z",
            "first": "2026-10-25T07:20:44Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 11658
        },
        "robots_txt": {
            "agents": [
                "*",
                "Amazonbot",
                "Applebot-Extended",
                "Bytespider",
                "CCBot"
            ],
            "present": true,
            "llms_txt": true,
            "sitemaps": [
                "https://rainbe-it.com/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 21
        },
        "social_tags": {
            "ogUrl": "https://rainbe-it.com/",
            "title": "Rainbet Italia: guida indipendente al brand nel 2026",
            "ogType": "article",
            "robots": "index,follow,max-image-preview:large,max-snippet:-1,max-video-preview:-1",
            "ogImage": "https://rainbe-it.com/images/rainbet-home.webp",
            "ogTitle": "Rainbet Italia: guida indipendente al brand nel 2026",
            "ogSiteName": "Rainbet Italia",
            "themeColor": "#071311",
            "description": "Rainbet Italia analizzato da una redazione indipendente: stato ADM, casino, app, bonus, giochi, pagamenti e alternative autorizzate.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://rainbe-it.com/",
            "ogDescription": "Rainbet Italia analizzato da una redazione indipendente: stato ADM, casino, app, bonus, giochi, pagamenti e alternative autorizzate."
        },
        "trackers": {
            "requests": 7
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 4,
                "tls": 50,
                "wait": 67,
                "connect": 8,
                "download": 1
            },
            "response_ms": 130
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 34829,
            "co2_grams": 0.0013,
            "cleaner_than": 45
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.192.105",
                    "host": "dana.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.195.44",
                    "host": "johnathan.ns.cloudflare.com"
                }
            ],
            "zone": "rainbe-it.com"
        },
        "location": {
            "ip": "2606:4700:3034::ac43:9920",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "rainbe-it.com"
        },
        "dns": {
            "A": [
                "104.21.80.187",
                "172.67.153.32"
            ],
            "NS": [
                "johnathan.ns.cloudflare.com",
                "dana.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"dana.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415144650, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3034::ac43:9920",
                "2606:4700:3035::6815:50bb"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3034::ac43:9920",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://rainbe-it.com"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.adm.gov.it/portale/siti-web-inibiti-giochi",
                "https://www.adm.gov.it/portale/documents/20182/114059352/elenco_siti_inibiti_giochi.txt/06a494fd-d135-680b-7a24-de79d1048f23",
                "https://www.adm.gov.it/portale/monopoli/giochi/gioco_distanza/gioco_dist_concessionari",
                "https://www.adm.gov.it/portale/inibizione-dei-siti-di-gioco-non-autorizzato",
                "https://rainbet.com/terms",
                "https://help.rainbet.com/en/",
                "https://help.rainbet.com/en/articles/9831951-deposit-bonus-terms-and-conditions",
                "https://help.rainbet.com/en/articles/15264824-kyc",
                "https://help.rainbet.com/en/articles/15267252-provably-fair"
            ],
            "external_count": 9,
            "internal_count": 32
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-08-27T12:44:25Z",
            "updated": "2026-08-27T12:48:55Z",
            "expires": "2027-08-27T12:44:25Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "dana.ns.cloudflare.com",
                "johnathan.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```