# PhishDestroy threat dossier — rainbet-ie.com ================================================================ Fetched: 2026-07-08 15:51:38 UTC Canonical: https://phishdestroy.io/domain/rainbet-ie.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 80/100 (PhishDestroy scoring — see methodology below) Targeted brand: Crypto Casino / Gambling ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 3/91 security vendors flagged this domain Flagging vendors: ChainPatrol, alphaMountain.ai, SOCRadar AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 103.217.252.135 (NL, Amsterdam) ASN: AS206264 Amarutu Technology Ltd Hosting org: HostUS Solutions LLC Registrar: URL SOLUTIONS INC. Nameservers: ns1.pananames.com, ns2.pananames.com, ns3.pananames.com, ns4.pananames.com Registered: 2025-10-24 Expires: 2027-10-24 Page title: Rainbet - Official Irish Crypto Casino and Sportsbook HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: none Status: INVALID chain ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2025-10-24 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-08 14:08:54 UTC (by PhishDestroy tracker) Last verified: 2026-07-08 16:25:10 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f41a0-abff-714a-9529-bcfe1e24f1c6/ Wayback Machine: https://web.archive.org/web/*/rainbet-ie.com crt.sh CT logs: https://crt.sh/?q=%25.rainbet-ie.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=rainbet-ie.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/rainbet-ie.com URLhaus: https://urlhaus.abuse.ch/host/rainbet-ie.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-08 14:16:15 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain is flagged as a high-risk brand impersonation threat targeting users of crypto gambling platforms. Analysis indicates the site mimics legitimate crypto casino services, specifically impersonating the Rainbet brand to deceive Irish users seeking gambling or sports betting opportunities. The threat type centers on credential harvesting, financial fraud, and potential cryptocurrency theft through fake login or deposit pages. Infrastructure analysis reveals the domain rainbet-ie.com was registered on October 24, 2025, through URL SOLUTIONS INC. It currently resolves to the IP address 103.217.252.135 and presents an SSL certificate issued for rainbet-ie.com. The page title, "Rainbet - Official Irish Crypto Casino and Sportsbook," reinforces the impersonation attempt. Security vendor detections on VirusTotal show 3 out of 95 engines flagging the domain as malicious. Additionally, the domain appears in one threat intelligence pulse on AlienVault OTX, further corroborating its suspicious nature. No reputable blocklists or trust scores currently list the domain as benign. Mitigation steps should prioritize blocking the domain and its associated IP address (103.217.252.135) at the network perimeter. Security teams are advised to monitor for user interactions with the domain, particularly login attempts or cryptocurrency transactions. Endpoint protection should be configured to alert on connections to rainbet-ie.com or its IP. User awareness training should emphasize the risks of brand impersonation in crypto gambling, including verification of SSL certificates and domain registration details before engaging with such platforms. Organizations handling financial or cryptocurrency-related operations should enforce strict domain validation policies to prevent credential theft or fraudulent transactions. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: fb5cebe5e4fd721c2246244b8e4d593b ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/rainbet-ie.com/ JSON API: https://api.destroy.tools/v1/check?domain=rainbet-ie.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 176,217 domains (13,356 alive under monitoring, 161,870 confirmed takedowns/dead). Site: https://phishdestroy.io