# PhishDestroy threat dossier — rainbet7-ie.com ================================================================ Fetched: 2026-07-22 14:04:52 UTC Canonical: https://phishdestroy.io/domain/rainbet7-ie.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 6/91 security vendors flagged this domain Flagging vendors: ChainPatrol, alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, SOCRadar AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.86.188.175 (CA, Toronto) ASN: AS32489 Amanah Tech Inc. Hosting org: Amanah Tech Inc Registrar: URL Solutions, Inc. Nameservers: ["ns1.pananames.com", "ns2.pananames.com", "ns3.pananames.com", "ns4.pananames.com"] Page title: Rainbet Casino Ireland | €500 Bonus + 200 Free Spins | Legit & Safe HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YE2 Expires: 2026-10-07 Status: INVALID chain Fingerprint: b2d5ea6f91d03314c477be6867cfc1dc8bc0cf47c40267f316714505ba9fd497 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-19 12:38:21 UTC (by PhishDestroy tracker) Last verified: 2026-07-22 12:22:47 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-20 00:17:45 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] rainbet7-ie.com Safety Check — Phishing Detected rainbet7-ie.com is currently active and has been classified as a high‑risk generic phishing site. The domain resolves to the IPv4 address 172.86.188.175, which is geolocated to Canada and is associated with Amanah Tech Inc. Authoritative name servers are ns1‑ns4.pananames.com, indicating use of the Pananames DNS service. The site presents a valid TLS certificate issued by Let’s Encrypt (identifier YE2) and returns HTTP 200 for the root page, suggesting a functional web server. The page title advertised in the HTTP response reads “Rainbet Casino Ireland | €500 Bonus + 200 Free Spins | Legit & Safe”, a typical lure for gambling‑related victims. The domain is listed on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show six of ninety‑one security vendors flagging the domain, and AlienVault OTX records the domain in two separate threat‑intel pulses. Registration was performed through URL Solutions, Inc. No additional technical artifacts such as malware payloads or command‑and‑control endpoints have been disclosed. Defenders should add the domain and its resolving IP to outbound and inbound deny lists, monitor DNS queries for the listed Pananames name servers, and ensure email and web filters are updated to block the observed page title pattern. Users should be warned not to follow links that claim “€500 Bonus” or “200 Free Spins” from unsolicited messages. Ongoing observation is advised to detect any changes in hosting or content. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 775240786642da45f3a8396666bf9da8 TLS cert SHA-256: b2d5ea6f91d03314c477be6867cfc1dc8bc0cf47c40267f316714505ba9fd497 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/rainbet7-ie.com/ JSON API: https://api.destroy.tools/v1/check?domain=rainbet7-ie.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 188,088 domains (57,533 alive under monitoring, 128,922 confirmed takedowns/dead). Site: https://phishdestroy.io