# PhishDestroy domain threat record: rainbetwetten.ch Content language: English Canonical HTML report: https://phishdestroy.io/domain/rainbetwetten.ch/ Machine-readable companion: https://phishdestroy.io/domain/rainbetwetten.ch/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-02 09:56:20 UTC - Last availability or vendor check: 2026-10-22 10:32:25 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 6/89 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: cs2 ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Registrar country in stored WHOIS data: NL - Last stored HTTP status: 200 - Registration date (registry RDAP, rainbetwetten.ch): 2026-05-25 12:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0618a-e5dd-73dd-983f-3e4443409837/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/rainbetwetten.ch - Certificate Transparency search: https://crt.sh/?q=%25.rainbetwetten.ch - Web Archive lookup: https://web.archive.org/web/*/https://rainbetwetten.ch/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview rainbetwetten.ch presents itself as the official Swiss home of Rainbet, with a German-language page titled "Rainbet - Offizieller Sportwetten & Casino Anbieter in der Schweiz." PhishDestroy classifies it as a gambling site flagged as fraudulent. It is aimed at Swiss and German-speaking sports bettors and casino players, especially those who fund accounts with crypto. We first saw it on 2026-09-02, and it was still online and serving content on 2026-10-19. How the scam works The Swiss .ch domain and the word "wetten" (betting) make the site look like a local, licensed branch of the Rainbet brand. Fraudulent gambling sites of this kind take deposits, often in crypto, and show a growing balance or winnings to keep the player invested. When the player tries to cash out, withdrawals stall behind invented verification steps, "unlock" fees or minimum turnover rules that never end. Every deposit, and any fee paid to release funds, is lost. Evidence Six of 89 VirusTotal engines flagged the domain on 2026-09-16: ChainPatrol, alphaMountain.ai, CRDF, Gridinsoft, SOCRadar and VIPRE. That count is modest, but the flags come from vendors that independently track crypto fraud and malicious web content. The domain is also listed by MetaMask and SEAL, two crypto-focused blocklists, in addition to PhishDestroy. Four AlienVault OTX threat pulses reference it as well, so other researchers are tracking it too. Infrastructure The domain was registered on 2026-05-25, roughly 100 days before we detected it. That gap leaves room to build out the fake storefront before promoting it. The site sits behind Cloudflare, with the address resolving to a Cloudflare network registered in Canada, so the real hosting location of the operator stays hidden. Its certificate comes from Google Trust Services, an automated issuer. The padlock only means the connection is encrypted and says nothing about whether the operator is legitimate. What to do Do not deposit on rainbetwetten.ch, and do not pay any withdrawal, tax or verification fee it demands. Paying more will not release your balance. If you sent crypto, keep the transaction hashes, deposit addresses and chat logs, then report them to your exchange and to the police. If you uploaded ID documents or reused a password, change that password elsewhere and watch for identity misuse. Security teams should block the domain at DNS and proxy level and flag its name and the Rainbet branding in Swiss-targeted ad and social media monitoring. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0618a-e5dd-73dd-983f-3e4443409837/ VirusTotal report: https://www.virustotal.com/gui/domain/rainbetwetten.ch Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rainbetwetten.ch Archived copy: https://web.archive.org/web/20260902095726/https://rainbetwetten.ch/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:48:39 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Qj7t24HB/2dd66369c2aa.png Captured: 2026-09-02 09:56:20 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a0618a-e5dd-73dd-983f-3e4443409837.png Captured: 2026-09-02 09:56:20 UTC Source report: https://urlscan.io/result/01a0618a-e5dd-73dd-983f-3e4443409837/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/84cbfbd1-203b-4c56-816e-038549cb6330.png Captured: 2026-09-02 10:02:11 UTC Source report: https://radar.cloudflare.com/scan/84cbfbd1-203b-4c56-816e-038549cb6330 SHA-256: 19dc84759c7516996d66abc4f09bb42990581f5d36dc7ecc1404a034e3b3019e - URLScan ยท 2026-09-02: https://screenshots.phishdestroy.io/us/01a06188-c538-746b-8b84-473b6c326b19.png Captured: 2026-09-02 09:52:34 UTC Source report: https://urlscan.io/result/01a06188-c538-746b-8b84-473b6c326b19/ SHA-256: e377166ba0587e08ab682db43181ad32c39f19a7f4a5f9688a7db096d36a61a0 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:55:01Z", "uuid": "01a0618a-e5dd-73dd-983f-3e4443409837", "scanned_at": "2026-09-02T09:54:55Z", "final_url": "https://rainbetwetten.ch/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://rainbetwetten.ch/", "from": "http://rainbetwetten.ch/", "status": 307 } ], "ip": "104.21.63.3", "domains": [ "fonts.gstatic.com", "static.cloudflareinsights.com", "fonts.googleapis.com" ], "ips": [ "172.253.124.94", "104.16.80.73", "173.194.219.95", "104.21.63.3" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "link_domains": [ "www.sucht-info.ch", "www.addictionsuisse.ch", "www.spielsucht.ch", "www.dargebotenehand.ch", "www.bag.admin.ch", "www.gamblingtherapy.org", "www.gamblersanonymous.org", "www.begambleaware.org", "www.ncpgambling.org" ], "doc_hash": "d691b3247e9d3d5c1e07a4bfdaadffcdedfa441f4a5bafa5fcd92ce1d1d36613", "script_hashes": [ "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8", "7f916b2e5bbf8482eae738a18560b2ae9d4ff48c62a8c2c0443e3c743ec55217" ], "globals": [ "__cfBeacon" ], "tls": { "san": [ "rainbetwetten.ch", "*.rainbetwetten.ch" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "rainbetwetten.ch", "protocol": "TLS 1.3", "valid_to": "2026-11-28T14:12:54Z", "valid_from": "2026-08-30T13:14:13Z" }, "domain_age_days": 99, "apex_age_days": 99, "tls_age_days": 2, "tls_valid_days": 90, "requests": 11, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 78, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:35:24Z", "uuid": "84cbfbd1-203b-4c56-816e-038549cb6330", "scanned_at": "2026-09-02T10:02:11Z", "final_url": "https://rainbetwetten.ch/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://rainbetwetten.ch/", "status": 307 }, { "url": "https://rainbetwetten.ch/", "status": 200 } ], "dom_hash": "90456e797f763ddd27ebd0dc74810b231e0026ab97449bbca0b30709787735e9", "doc_hash": "99bf6989c2044696dedcb8f527d81dba9c39eaed5a45c44d3f9f39dea888f26c", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "rainbetwetten.ch", "type": "A", "value": "188.114.96.0" }, { "name": "rainbetwetten.ch", "type": "A", "value": "188.114.97.0" }, { "name": "rainbetwetten.ch", "type": "AAAA", "value": "2a06:98c1:3120::" }, { "name": "rainbetwetten.ch", "type": "AAAA", "value": "2a06:98c1:3121::" } ], "dnssec_valid": false, "ip": "188.114.96.0" } } ```