# PhishDestroy domain threat record: rainbet-de.de.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/rainbet-de.de.com/ Machine-readable companion: https://phishdestroy.io/domain/rainbet-de.de.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-09 08:56:37 UTC - Last availability or vendor check: 2026-10-21 22:32:52 UTC - Stored record updated: 2026-10-22 14:23:54 UTC - VirusTotal detections in the stored snapshot: 0/89 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ankr ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Registration date (registry RDAP, de.com): 1990-07-19 04:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a08561-4285-743b-bb93-9d94358ccbec/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/rainbet-de.de.com - Certificate Transparency search: https://crt.sh/?q=%25.rainbet-de.de.com - Web Archive lookup: https://web.archive.org/web/*/https://rainbet-de.de.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview rainbet-de.de.com was an impersonation phishing page posing as a German edition of the Rainbet casino. Its title, "Rainbet Casino Online Deutschland: Boni beanspruchen und schnelle Auszahlungen", promised players in Germany bonuses and fast withdrawals under the Rainbet name. PhishDestroy first flagged it on 2026-09-09. The site went offline on 2026-09-14 and was still dead when rechecked on 2026-10-19. How the scam works Lookalike casino sites trade on a real brand's reputation. A localized domain and a bonus-heavy pitch make visitors believe they have found an official regional mirror. Victims are then pushed to sign up, enter login details or fund an account, often in crypto, to claim the advertised bonus. The "fast payouts" never come. Deposits go straight to the operators, and any credentials typed in can be reused against the victim's genuine Rainbet account. Evidence urlscan.io rated the page malicious and matched it to a generic gambling brand template, which fits a cloned casino front. The domain is listed by PhishDestroy, MetaMask and SEAL, so two independent crypto-security blocklists reached the same conclusion. VirusTotal tells a different story: none of its 89 engines flagged the domain as of 2026-09-16. Conventional antivirus coverage would not have protected a visitor here. Infrastructure The name sits under de.com, a namespace that mimics a German country domain, which helps it pass as a local Rainbet site at a glance. The registration date reported for it, 1990-07-19, belongs to that parent namespace and says nothing about when this particular name was set up. Traffic ran through Cloudflare's network in the US, which hides the real origin server. A free Let's Encrypt certificate gave the page a padlock, so the padlock was no sign it was genuine. What to do If you deposited funds through this site, treat them as lost to the operators. Ignore any later message offering to release a "pending" balance in exchange for a fee or verification payment. If you entered a username, email or password, change it immediately on the real Rainbet account and anywhere else you reused it, then turn on two-factor authentication. Report crypto transfers to the exchange you sent them from, and file a police report with the transaction details. Defenders should block this domain and watch for other Rainbet lookalikes under de.com and similar regional-looking namespaces, since VirusTotal-based filtering missed this one. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a08561-4285-743b-bb93-9d94358ccbec/ VirusTotal report: https://www.virustotal.com/gui/domain/rainbet-de.de.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rainbet-de.de.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:20:35 UTC ## Stored page captures - Primary capture: https://i.ibb.co/gL7mQzds/219a787caff1.png Captured: 2026-09-09 08:56:37 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a08561-4285-743b-bb93-9d94358ccbec.png Captured: 2026-09-09 08:56:37 UTC Source report: https://urlscan.io/result/01a08561-4285-743b-bb93-9d94358ccbec/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/87f67c13-ae4e-4a6f-b328-a4b0da4f5375.png Captured: 2026-09-09 09:29:33 UTC Source report: https://radar.cloudflare.com/scan/87f67c13-ae4e-4a6f-b328-a4b0da4f5375 SHA-256: 2dd73764a4e99860953b80d7e95b611475e92958134eb27db2cc1a5db7e4563f - URLScan ยท 2026-09-09: https://screenshots.phishdestroy.io/us/01a0855c-7995-7788-80b5-83972c3a6a00.png Captured: 2026-09-09 08:50:33 UTC Source report: https://urlscan.io/result/01a0855c-7995-7788-80b5-83972c3a6a00/ SHA-256: ea8d71eab754ecc71b3ed7b73055789df1021d20d463462802cbf85cae242b3f ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T02:24:51Z", "uuid": "01a08561-4285-743b-bb93-9d94358ccbec", "scanned_at": "2026-09-09T08:55:46Z", "final_url": "https://rainbet-de.de.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://rainbet-de.de.com/", "from": "http://rainbet-de.de.com/", "status": 307 } ], "ip": "188.114.96.12", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "142.251.14.94", "2a00:1450:4001:c17::5f", "188.114.96.12" ], "asns": [ "15169", "13335" ], "countries": [ "US", "DE" ], "doc_hash": "56a5b0cfad91b5a4e93d75b53b366b38d4f5526676a51205d296754bc90659bb", "script_hashes": [ "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8", "e69c01b6b4e8a90c8cee69436db4ff1bb8fcebd73888f21b8c4bdbbd734f8047", "33b743a046b041f7393ef221ee6c36259c27409065b8cf4b82acc12a1ca41fc0", "a45e21591a80a99552fd189d0458e903071f96ef2a7bbe50b914b7fd5644b84e" ], "cookies": [ "bn_source", "bn_firstpage" ], "tls": { "san": [ "*.rainbet-de.de.com", "rainbet-de.de.com" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "rainbet-de.de.com", "protocol": "QUIC", "valid_to": "2026-10-11T03:52:23Z", "valid_from": "2026-07-13T03:52:24Z" }, "domain_age_days": 176, "apex_age_days": 176, "tls_age_days": 58, "tls_valid_days": 89, "requests": 67, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 91, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericgambling" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Gambling" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T02:35:39Z", "uuid": "87f67c13-ae4e-4a6f-b328-a4b0da4f5375", "scanned_at": "2026-09-09T09:29:33Z", "final_url": "https://rainbet-de.de.com/", "status": 200, "history": [ { "url": "https://rainbet-de.de.com/", "status": 200 } ], "dom_hash": "451667967e7e41c6f1dc3cdad5799ef6055b26853cb6b2e3efa33ef333efa2db", "doc_hash": "2625a8dcef5f369f910c2671ff2f99e442829fb36cc34ffebfa552d28f4cc34f", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "rainbet-de.de.com", "type": "A", "value": "188.114.96.0" }, { "name": "rainbet-de.de.com", "type": "A", "value": "188.114.97.0" }, { "name": "rainbet-de.de.com", "type": "AAAA", "value": "2a06:98c1:3121::" }, { "name": "rainbet-de.de.com", "type": "AAAA", "value": "2a06:98c1:3120::" } ], "dnssec_valid": false, "ip": "188.114.96.0", "whois": { "registrar": "NameCheap, Inc.", "created": "2026-03-12T12:59:04Z", "updated": "2026-04-01T14:24:23Z", "expires": "2027-03-12T23:59:59Z", "nameservers": [ "dave.ns.cloudflare.com", "leah.ns.cloudflare.com" ] } } } ```