rainbet-france[.]com

rainbet-france.com was observed returning HTTP status 200 on 22 July 2026. The page title advertised “RainBet Casino – Jeux en direct avec croupiers France | Bonus exclusifs”, indicating an attempt to lure French‑speaking users toward an online gambling service. The site loads third‑party libraries such as SweetAlert2 and jsDelivr and is fronted by Cloudflare, which also supplies HTTP/3 support and Browser Insights. SSL is provided by Google Trust Services under the WE1 certificate, confirming a valid TLS chain.

Infrastructure analysis shows the domain resolves to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc. and located in the United States. Registration information lists Dynadot LLC as the registrar, with the domain creation date of 19 December 2025 and authoritative nameservers gemma.ns.cloudflare.com and titan.ns.cloudflare.com. Threat intelligence signals include two detections out of ninety‑one vendors on VirusTotal, placement on three public blocklists, and inclusion in two AlienVault OTX pulses. The domain is also listed by PhishDestroy, MetaMask, and SEAL as a blocked entity.

These indicators collectively suggest active abuse consistent with a generic phishing campaign targeting users of the RainBet brand. While the page content has not been independently verified, the combination of a gambling‑related title, the use of reputable CDN services, and the presence on multiple security feeds indicate a high‑risk profile. Defenders should block the domain at the network perimeter, update DNS‑based filtering lists with the observed IP address and nameservers, and monitor for any credential‑stealing payloads that might be delivered through the loaded JavaScript libraries. Continued observation of the domain’s status and periodic rescans with VirusTotal are recommended to track any changes in detection rates.