pl-rainbet[.]com

Analysis of the domain pl-rainbet.com, observed on August 07, 2026, indicates active malicious infrastructure consistent with a generic phishing operation. The domain resolves to the IPv4 address 172.67.184.172 and is hosted behind Cloudflare, Inc., as evidenced by the authoritative nameservers leif.ns.cloudflare.com and raphaela.ns.cloudflare.com. Registration data shows the domain was created on July 21, 2026, and the registrar entry lists Cloudflare, Inc., confirming that the domain’s DNS is fully managed by the same provider.

Reputation data demonstrates that the domain appears on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the assessment of high‑risk activity. VirusTotal reports that the domain has been scanned by 91 vendor engines; at the time of analysis no engines have raised a detection, a condition the report treats solely as an absence of current flags and not as evidence of benign intent. The threat level is classified as high, and the operational status remains active.

Uncertainties remain regarding the specific phishing content, target brand, or payload delivery mechanism, as no page title, SSL certificate details, or HTTP response codes are available in the current intelligence set. Defenders should proactively block the domain at the network perimeter, update intrusion‑prevention signatures to include the associated IP address, and monitor for any future detections from additional scanning services. Continuous observation of the listed blocklists and the three blocking entities is advised to capture any escalation or changes in the domain’s behavior.