# PhishDestroy domain threat record: rainbet-enlinea.es

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/rainbet-enlinea.es/
Machine-readable companion: https://phishdestroy.io/domain/rainbet-enlinea.es/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-08 10:03:39 UTC
- Last availability or vendor check: 2026-10-22 22:33:56 UTC
- Stored record updated: 2026-10-22 22:33:56 UTC
- VirusTotal detections in the stored snapshot: 7/89
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Linea

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 301

## Evidence links

- URLScan report: https://urlscan.io/result/01a08078-09a7-7459-9cef-4bf67e7aa684/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/rainbet-enlinea.es
- Certificate Transparency search: https://crt.sh/?q=%25.rainbet-enlinea.es
- Web Archive lookup: https://web.archive.org/web/*/https://rainbet-enlinea.es/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
rainbet-enlinea.es is an impersonation phishing page that trades on the name of Linea, the Ethereum layer-2 network. It wraps itself in a Spanish-language crypto casino pitch aimed at Spanish-speaking gamblers who hold funds on Linea. PhishDestroy first flagged it on 2026-09-08. As of 2026-10-19 the domain was still live and redirecting visitors elsewhere.

How the scam works
The page title reads "Rainbet Casino – 100% hasta 700 $ en tragaperras y en vivo", a matched-deposit bonus promising up to $700 on slots and live games. A generous welcome bonus is a common way to get a visitor to connect a wallet or send a first deposit quickly. Pages like this typically ask the user to approve a transaction or sign a message presented as a deposit or bonus claim. That approval can then be used to move tokens out of the wallet, and any direct deposit is simply kept. The title advertises a casino, while our classification is impersonation of the Linea brand. Both describe the same domain.

Evidence
On 2026-09-18, VirusTotal showed 7 of 89 engines flagging the domain. They were ChainPatrol, alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft and SOCRadar. The count is modest, but the crypto-focused vendors carry weight. MetaMask and the SEAL security alliance both list the domain, so many wallet users should see a warning before reaching it. Spamhaus classifies it as phishing in its domain blocklist, and four AlienVault OTX threat pulses reference it.

Infrastructure
The site sits behind Cloudflare's network in the US, which hides the real origin server from public view. Its certificate comes from Google Trust Services (WE1), which is standard for Cloudflare-fronted sites. The padlock only means the connection is encrypted, not that the site is legitimate. The live redirect means the domain can quietly send traffic to whatever destination the operators choose next.

What to do
If you connected a wallet or signed anything on this site, open a token approval checker for Linea and Ethereum and revoke any permission you don't recognize. Then move your remaining assets to a fresh wallet. Never chase a lost deposit by paying "verification" or "unlock" fees, because those payments are kept as well. If you entered a seed phrase, treat that wallet as compromised and abandon it. Defenders should block the domain at DNS and the proxy, add it to crypto-wallet warning lists, and watch for look-alike Rainbet or Linea domains using the same Spanish bonus wording.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a08078-09a7-7459-9cef-4bf67e7aa684/
VirusTotal report: https://www.virustotal.com/gui/domain/rainbet-enlinea.es
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rainbet-enlinea.es
Archived copy: https://web.archive.org/web/20260921233335/https://rainbet-enlinea.es/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:47:40 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/yBnw0rXN/acb4b8e27082.png
  Captured: 2026-09-08 10:03:39 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a08078-09a7-7459-9cef-4bf67e7aa684.png
  Captured: 2026-09-08 10:03:39 UTC
  Source report: https://urlscan.io/result/01a08078-09a7-7459-9cef-4bf67e7aa684/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/44bbabfc-4afc-4f8e-ad23-d965209c87aa.png
  Captured: 2026-09-08 10:05:11 UTC
  Source report: https://radar.cloudflare.com/scan/44bbabfc-4afc-4f8e-ad23-d965209c87aa
  SHA-256: e569995a2c39eb2c2f683a15bca6c08b7cda52bdbc7f6e048f667612eacaf0c1
- URLScan · 2026-09-08: https://screenshots.phishdestroy.io/us/01a08077-7d8e-7262-9939-91add844c826.png
  Captured: 2026-09-08 10:01:58 UTC
  Source report: https://urlscan.io/result/01a08077-7d8e-7262-9939-91add844c826/
  SHA-256: 5ccdf9cfd338868e78154859f488fb64d3fa312a1126a8773868b088f4acb007

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T02:28:18Z",
        "uuid": "01a08078-09a7-7459-9cef-4bf67e7aa684",
        "scanned_at": "2026-09-08T10:02:36Z",
        "final_url": "https://rainbet-enlinea.es/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://rainbet-enlinea.es/",
                "from": "http://rainbet-enlinea.es/",
                "status": 307
            }
        ],
        "ip": "188.114.96.3",
        "domains": [
            "mc.yandex.com",
            "mc.yandex.ru"
        ],
        "ips": [
            "77.88.21.119",
            "188.114.96.3"
        ],
        "asns": [
            "13238",
            "13335"
        ],
        "countries": [
            "RU"
        ],
        "link_domains": [
            "www.jugarbien.es",
            "fejar.org",
            "www.bestchange.com",
            "www.trustpilot.com"
        ],
        "doc_hash": "c96421bdc640c919bb317cecc2a9a43ed1a2f8bfae678a48dadea5184a3db4e8",
        "script_hashes": [
            "441bd1ccfd1bb0c8c8a71991195d38cc30ae7c036ecef8b8b1637d50c268b0d8",
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8"
        ],
        "globals": [
            "ym",
            "_hdClickBound",
            "_cgClickBound",
            "goRedirect",
            "Ya",
            "yaCounter106172094"
        ],
        "cookies": [
            "bh",
            "_ym_uid",
            "_ym_d",
            "sync_cookie_csrf",
            "_ym_isad",
            "yabs-sid",
            "i",
            "yandexuid",
            "yuidss",
            "ymex",
            "sync_cookie_csrf_secondary",
            "sync_cookie_ok_secondary"
        ],
        "storage_keys": [
            "_ymBRC",
            "_ym_synced",
            "_ym106172094_lsid",
            "_ym106172094:0_reqNum",
            "_ym_uid",
            "_ym_retryReqs",
            "_ym_jn"
        ],
        "tls": {
            "san": [
                "rainbet-enlinea.es",
                "*.rainbet-enlinea.es"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "rainbet-enlinea.es",
            "protocol": "QUIC",
            "valid_to": "2026-11-29T19:47:09Z",
            "valid_from": "2026-08-31T18:48:32Z"
        },
        "domain_age_days": 127,
        "apex_age_days": 127,
        "tls_age_days": 7,
        "tls_valid_days": 90,
        "requests": 70,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 81,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T03:57:38Z",
        "uuid": "44bbabfc-4afc-4f8e-ad23-d965209c87aa",
        "scanned_at": "2026-09-08T10:05:11Z",
        "final_url": "https://rainbet-enlinea.es/",
        "status": 200,
        "history": [
            {
                "url": "https://rainbet-enlinea.es/",
                "status": 200
            }
        ],
        "dom_hash": "9fefc1f22c6573e90d2dc36276864ddb6134198a59f1f8408eb59d037df0e5ec",
        "doc_hash": "2d0504c954095bac022da6dba0f7e8ae27791bdd87e3e5b38487847b696d622d",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "rainbet-enlinea.es",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "rainbet-enlinea.es",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "rainbet-enlinea.es",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            },
            {
                "name": "rainbet-enlinea.es",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.97.0"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T23:32:18Z",
        "analysis_at": "2026-10-09T16:17:23Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 6,
            "suspicious": 2,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "ChainPatrol": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Dr.Web": "gambling/not recommended site",
            "Google": "gambling",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "first_seen": "2026-05-03T11:03:03Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.213.183"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "dante.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dayana.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:d5b7"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dante.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::6815:5606"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.86.6"
            }
        ],
        "dns_at": "2026-10-09T16:21:54Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "rainbet-enlinea.es",
                "*.rainbet-enlinea.es"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "2f412da4fd9009650e5becd1b91913ca",
            "sha256": "8f07109a14848c129451b9b3ba16090ab5b476e751307d64e4872b6d356308b7",
            "subject": "rainbet-enlinea.es",
            "valid_to": "2026-11-29T19:47:09Z",
            "valid_from": "2026-08-31T18:48:32Z"
        }
    }
}
```