plinko-rainbets[.]com

Analysis indicates that the domain plinko-rainbets.com is actively employed in a generic phishing campaign. The registration record shows the domain was created on July 08 2026 through URL SOLUTIONS INC. and resolves to the IP address 172.67.209.237, which is hosted by Cloudflare as indicated by the authoritative nameservers tricia.ns.cloudflare.com and walt.ns.cloudflare.com. Within a few days of activation the domain has been added to three external security blocklists and is listed by the phishing mitigation services PhishDestroy, MetaMask and SEAL.

VirusTotal scans have resulted in seven out of ninety‑five antivirus engines flagging the host, confirming malicious intent. No additional infrastructure details such as ASN, geographic location, SSL certificate attributes or HTTP response codes are currently published. The lack of a public page title or content analysis prevents a deeper assessment of the lure used, but the presence on multiple blocklists and the early VirusTotal detections strongly suggest that the site is being used to harvest credentials or other sensitive data.

Defenders should immediately block DNS resolution for plinko‑rainbets.com and any sub‑domains, enforce outbound filtering to prevent connections to the resolving IP address, and monitor for anomalous authentication attempts that may be linked to this host. Continuous re‑evaluation is advised, as threat actors may shift hosting or modify the domain to bypass existing controls. Organizations employing threat‑intel feeds should incorporate the observed indicators—creation date, registrar, nameservers, IP, and blocklist listings—into their detection rules to improve early discovery of related phishing infrastructure.