# PhishDestroy domain threat record: toprainbetfr.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/toprainbetfr.shop/
Machine-readable companion: https://phishdestroy.io/domain/toprainbetfr.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 18:43:29 UTC
- Last availability or vendor check: 2026-10-24 10:56:38 UTC
- Stored record updated: 2026-10-24 18:25:05 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: mastercard

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Namecheap, Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-04 18:31:15 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16a11-6839-7259-a872-3b3287fad001/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/toprainbetfr.shop
- Certificate Transparency search: https://crt.sh/?q=%25.toprainbetfr.shop
- Web Archive lookup: https://web.archive.org/web/*/https://toprainbetfr.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified toprainbetfr.shop as malicious because it advertises a gambling platform called Rainbet Casino France with large bonus and rakeback promises, a pattern commonly used by fraudulent gambling operations. The domain was first seen by PhishDestroy on 2026-10-23 and returned an HTTP 200 response at that time. The recorded page title reads “Rainbet Casino France : bonus $700 + rakeback”.

How the scam works
Typical online gambling scams lure victims with oversized sign‑up bonuses, guaranteed rakeback, or high‑return promises and require deposits in cryptocurrency. After funds are transferred, the operator may block withdrawals, disappear, or manipulate odds, resulting in financial loss for the victim.

Evidence
VirusTotal scanned the domain on 2026-10-22 and reported 0 detections out of 92 engines. Google Safe Browsing checked on 2026-10-23 and did not flag the site, while external blocklists MetaMask and SEAL listed the domain on the same day. PhishDestroy’s internal list marked the domain as malicious on 2026-10-23, OTX recorded four pulses referencing it on that date, and URLScan’s machine‑learning engine flagged the page as malicious with a score of 90 on 2026-10-23, though its overall verdict was non‑malicious.

Infrastructure
The recorded TLS certificate for toprainbetfr.shop was issued by Let’s Encrypt / YE1 and was valid from 2026-10-04 to 2027-01-02. The recorded IP addresses were 188.114.96.3 and 188.114.97.3, both associated with the Cloudflare network in GB. The domain and its certificate were 18 days old at the time of the scan and the site employed Cloudflare’s web‑application firewall.

What to do
Users should avoid visiting the site and should not provide any cryptocurrency, personal credentials, or payment information. If credentials were entered, change the associated passwords immediately. Defenders should block toprainbetfr.shop at network perimeters, monitor for connections to the recorded Cloudflare IPs, and review logs for any recent activity to the domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16a11-6839-7259-a872-3b3287fad001/
Cloudflare Radar report: https://radar.cloudflare.com/scan/e528b3bd-5d24-44e8-8ee7-0ce9499c74b5
Stored capture screenshot: https://urlscan.io/screenshots/01a16a11-6839-7259-a872-3b3287fad001.png
Cloudflare Radar screenshot (2026-10-23T18:44:00Z): https://screenshots.phishdestroy.io/cf/e528b3bd-5d24-44e8-8ee7-0ce9499c74b5.png
URLScan screenshot (2026-10-23T18:43:26Z): https://screenshots.phishdestroy.io/us/01a16a13-1ba4-7103-b8ed-cb94fb9b3fd5.png
URLScan capture report: https://urlscan.io/result/01a16a13-1ba4-7103-b8ed-cb94fb9b3fd5/
VirusTotal report: https://www.virustotal.com/gui/domain/toprainbetfr.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=toprainbetfr.shop
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 21:16:04 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16a11-6839-7259-a872-3b3287fad001.png
  Captured: 2026-10-23 18:43:29 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a16a11-6839-7259-a872-3b3287fad001.png
  Captured: 2026-10-23 18:43:29 UTC
  Source report: https://urlscan.io/result/01a16a11-6839-7259-a872-3b3287fad001/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e528b3bd-5d24-44e8-8ee7-0ce9499c74b5.png
  Captured: 2026-10-23 18:44:00 UTC
  Source report: https://radar.cloudflare.com/scan/e528b3bd-5d24-44e8-8ee7-0ce9499c74b5
  SHA-256: bf73b32fc407d5d9da8693b4b37bd3fad54e6365f3cf6ff6eb9096bda16d0a6f
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16a13-1ba4-7103-b8ed-cb94fb9b3fd5.png
  Captured: 2026-10-23 18:43:26 UTC
  Source report: https://urlscan.io/result/01a16a13-1ba4-7103-b8ed-cb94fb9b3fd5/
  SHA-256: 7dbc663e45dadf8a409e930cebbe320268714d9bf654b1357c0a6a56426ec4f6

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T18:44:14Z",
        "uuid": "01a16a11-6839-7259-a872-3b3287fad001",
        "scanned_at": "2026-10-23T18:41:37Z",
        "final_url": "https://toprainbetfr.shop/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://toprainbetfr.shop/",
                "from": "http://toprainbetfr.shop/",
                "status": 307
            }
        ],
        "ip": "172.67.175.64",
        "domains": [
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.16.79.73",
            "172.67.175.64"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "c58293e010bd2bd2f9daea28da38c441d0f59dbb352e7e1d15f6ce55dc118736",
        "script_hashes": [
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8",
            "c68f7829ec897b280ef9464d24549ce61793fc8807c18fe2c4469528086f2d21"
        ],
        "globals": [
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "*.toprainbetfr.shop",
                "toprainbetfr.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "toprainbetfr.shop",
            "protocol": "QUIC",
            "valid_to": "2027-01-02T19:54:35Z",
            "valid_from": "2026-10-04T19:54:36Z"
        },
        "domain_age_days": 18,
        "apex_age_days": 18,
        "tls_age_days": 18,
        "tls_valid_days": 89,
        "requests": 13,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 90,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T18:44:20Z",
        "uuid": "e528b3bd-5d24-44e8-8ee7-0ce9499c74b5",
        "scanned_at": "2026-10-23T18:44:00Z",
        "final_url": "https://toprainbetfr.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://toprainbetfr.shop/",
                "status": 200
            }
        ],
        "dom_hash": "9ffcf1cac26219797f1eeb2261035fdfa4767a0e3ac41d163ac9f40192cb4cf0",
        "doc_hash": "8e85853e5181e684d74e8ca51f2117c7cd00fef8075ea73fd3445b56d39ac24d",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "toprainbetfr.shop",
                "type": "A",
                "value": "188.114.97.2"
            },
            {
                "name": "toprainbetfr.shop",
                "type": "A",
                "value": "188.114.96.2"
            },
            {
                "name": "toprainbetfr.shop",
                "type": "AAAA",
                "value": "2a06:98c1:3121::2"
            },
            {
                "name": "toprainbetfr.shop",
                "type": "AAAA",
                "value": "2a06:98c1:3120::2"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.97.2"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T21:15:30Z",
        "analysis_at": "2026-10-22T11:16:49Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "first_seen": "2026-10-05T01:01:06Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:af40"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "jimmy.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.175.64"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:1f46"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "jimmy.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "piper.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.31.70"
            }
        ],
        "dns_at": "2026-10-22T11:19:09Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.toprainbetfr.shop",
                "toprainbetfr.shop"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "62f6b796dec77d886585c9cccb31da11297",
            "sha256": "015aa8901277698ef07e7fd69620c6848e80e38d6a4b2cb40f9eef26ed747365",
            "subject": "toprainbetfr.shop",
            "valid_to": "2027-01-02T19:54:35Z",
            "valid_from": "2026-10-04T19:54:36Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T18:44:33Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "toprainbetfr.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-23T18:44:11Z",
            "first": "2026-10-04T21:19:41Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.05,
            "avg_page_bytes": 7520
        },
        "robots_txt": {
            "agents": [
                "*",
                "MJ12bot",
                "PetalBot"
            ],
            "present": true,
            "sitemaps": [
                "https://toprainbetfr.shop/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 16
        },
        "social_tags": {
            "ogUrl": "https://toprainbetfr.shop/",
            "title": "Rainbet Casino France : bonus $700 + rakeback",
            "ogType": "website",
            "robots": "index,follow",
            "ogImage": "https://toprainbetfr.shop/assets/landscape.webp",
            "ogTitle": "Rainbet Casino France : bonus $700 + rakeback",
            "ogSiteName": "Rainbet",
            "description": "Rainbet en France : 100% jusqu'à $700 et 20 tours gratuits par dépôt, plus de 7 000 jeux, rakeback toutes les 15 minutes et chat 24/7 en français.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://toprainbetfr.shop/",
            "ogDescription": "Rainbet en France : 100% jusqu'à $700 et 20 tours gratuits par dépôt, plus de 7 000 jeux, rakeback toutes les 15 minutes et chat 24/7 en français."
        },
        "trackers": {
            "requests": 10
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 4,
                "tls": 19,
                "wait": 95,
                "connect": 6,
                "download": 1
            },
            "response_ms": 125
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 60314,
            "co2_grams": 0.0022,
            "cleaner_than": 33
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.35",
                    "host": "piper.ns.cloudflare.com"
                },
                {
                    "ip": "162.159.44.76",
                    "host": "jimmy.ns.cloudflare.com"
                }
            ],
            "zone": "toprainbetfr.shop"
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "toprainbetfr.shop"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "NS": [
                "jimmy.ns.cloudflare.com",
                "piper.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"jimmy.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416640890, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://toprainbetfr.shop"
            ]
        },
        "linked_pages": {
            "internal_count": 20
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```