# PhishDestroy domain threat record: rainbet-eu-de.pages.dev Content language: English Canonical HTML report: https://phishdestroy.io/domain/rainbet-eu-de.pages.dev/ Machine-readable companion: https://phishdestroy.io/domain/rainbet-eu-de.pages.dev/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-17 03:11:17 UTC - Last availability or vendor check: 2026-10-22 10:06:54 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 4/91 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: MetaMask ## Stored infrastructure - Observed IP address: 188.114.97.9 - Registrar in stored WHOIS data: CloudFlare, Inc. - Last stored HTTP status: 200 - Registration date (registry RDAP, pages.dev): 2020-09-02 02:33:29 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/rainbet-eu-de.pages.dev - Certificate Transparency search: https://crt.sh/?q=%25.rainbet-eu-de.pages.dev - Web Archive lookup: https://web.archive.org/web/*/https://rainbet-eu-de.pages.dev/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview rainbet-eu-de.pages.dev is a fraudulent gambling site that uses the Rainbet casino brand and is aimed at German-speaking players. Its German page title advertises a guaranteed $25,000 daily race. PhishDestroy first saw the site on 2026-09-17, and it was still online with live content on 2026-10-19. How the scam works The page title, "Rainbet Casino Deutschland ᐉ 25.000 $ Tägliches Rennen Sichern!", uses a large daily prize pool to make visitors feel they must sign up quickly. Fraudulent casinos like this usually ask players to deposit funds, often in cryptocurrency, and may show winnings or leaderboard positions that cannot actually be withdrawn. When a player tries to cash out, the site may demand more deposits, verification payments or "fees", or simply stop responding. Deposits sent to such a site are generally lost, and crypto transfers cannot be reversed. Evidence On 2026-10-01, four of 91 VirusTotal engines flagged the domain: ChainPatrol, alphaMountain.ai, Forcepoint ThreatSeeker and VIPRE. That is a low count, but ChainPatrol focuses on crypto threats, so its flag is relevant to a casino aimed at crypto users. The domain also appears on the MetaMask and SEAL blocklists in addition to PhishDestroy's, so wallet users on those protections should see warnings. Infrastructure The site runs on a free Cloudflare Pages subdomain, which costs nothing to set up and is easy to replace if taken down. The domain was registered on 2026-09-11, six days before PhishDestroy detected it, which fits a short-lived scam. It resolves to Cloudflare, Inc. infrastructure geolocated to Canada, and it uses a Google Trust Services certificate. The certificate only means the connection is encrypted and says nothing about whether the site is legitimate. What to do Do not deposit anything, and do not pay any fee the site requests to release winnings, because that money will not come back. If you already sent crypto, write down the transaction hashes and receiving addresses and report them to the exchange you sent from and to local police. If you registered with an email and password, change that password everywhere you reused it. Security teams should block the hostname, and hosting abuse teams can report it to Cloudflare for removal. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/rainbet-eu-de.pages.dev Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rainbet-eu-de.pages.dev Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:47:24 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/afb82291-7c95-4ff4-8e6d-8e4c01efdb28.png Captured: 2026-09-23 07:53:39 UTC Source report: https://radar.cloudflare.com/scan/afb82291-7c95-4ff4-8e6d-8e4c01efdb28 SHA-256: e210ee9da575b19896b55fc9c8fe3210e413d45c9d2b8292ebf5fb22eb2791eb - URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0ad5e-b4b0-745a-bb9b-d60105b449f3.png Captured: 2026-09-17 03:17:47 UTC Source report: https://urlscan.io/result/01a0ad5e-b4b0-745a-bb9b-d60105b449f3/ SHA-256: abb6a74103cd401a7a276a583a1bd8536fb781bbe2c708ac3ddeb53560c78ed0 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:29:45Z", "uuid": "afb82291-7c95-4ff4-8e6d-8e4c01efdb28", "scanned_at": "2026-09-23T07:53:39Z", "final_url": "https://rainbet-eu-de.pages.dev/", "status": 200, "history": [ { "url": "https://rainbet-eu-de.pages.dev/", "status": 200 } ], "dom_hash": "ff184213cfc56dd230f1829833e9c5f6c55b3c9ed28838b466d62d2270ac595a", "doc_hash": "4f2a57719cd89184480a720b3ce2a361153575e8432c79dfce1fb6ddc29a8378", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "rainbet-eu-de.pages.dev", "type": "A", "value": "172.66.44.85" }, { "name": "rainbet-eu-de.pages.dev", "type": "A", "value": "172.66.47.171" }, { "name": "rainbet-eu-de.pages.dev", "type": "AAAA", "value": "2606:4700:310c::ac42:2fab" }, { "name": "rainbet-eu-de.pages.dev", "type": "AAAA", "value": "2606:4700:310c::ac42:2c55" } ], "dnssec_valid": false, "ip": "172.66.44.85", "whois": { "registrar": "CloudFlare, Inc.", "created": "2020-09-02T02:33:29Z", "updated": "2026-06-09T12:00:52Z", "expires": "2027-09-02T02:33:29Z", "nameservers": [ "adi.ns.cloudflare.com", "karl.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T00:28:10Z", "analysis_at": "2026-10-14T04:55:06Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 4, "suspicious": 1, "undetected": 33 }, "detections": { "VIPRE": "malware", "URLQuery": "suspicious", "ChainPatrol": "malicious", "alphaMountain.ai": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "registrar": "CloudFlare, Inc.", "created": "2020-09-02T02:33:29Z", "expires": "2026-09-02T02:33:29Z", "updated": "2025-03-17T14:56:22Z", "first_seen": "2026-09-13T18:37:11Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "cruz.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.66.44.85" }, { "ttl": 300, "type": "A", "value": "172.66.47.171" }, { "ttl": 21600, "type": "NS", "value": "cruz.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:310c::ac42:2fab" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:310c::ac42:2c55" }, { "ttl": 21600, "type": "NS", "value": "woz.ns.cloudflare.com" } ], "dns_at": "2026-10-14T04:55:44Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "rainbet-eu-de.pages.dev", "*.rainbet-eu-de.pages.dev" ], "issuer": "Google Trust Services / WE1", "serial": "d73d44724b0fbffa0e366a06abe4073a", "sha256": "9fcc61eed73163d941964602cc071f99eeb57f76b192bc68e95c6868ec6d2b50", "subject": "rainbet-eu-de.pages.dev", "valid_to": "2026-12-10T18:05:04Z", "valid_from": "2026-09-11T17:06:25Z" }, "whois": { "registrar": "CloudFlare, Inc.", "registrar_iana_id": "1910", "registrar_url": "None", "created": "2020-09-02T02:33:29Z", "updated": "2023-09-04T18:15:07Z", "expires": "2026-09-02T02:33:29Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited", "clientdeleteprohibited", "clienttransferprohibited", "clientupdateprohibited" ], "nameservers": [ "adi.ns.cloudflare.com", "karl.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```