rainbet.de Phishing Infrastructure – Active Threat

Analysis indicates that the domain rainbet.de is currently resolving to the IPv4 address 185.104.28.238 and is served by the authoritative name servers ns.zxcs.be, ns.zxcs.eu and ns.zxcs.nl. The domain remains active as of the report date (15 July 2026) and is classified under the generic_phishing threat type with a risk level of under_investigation. VirusTotal records show that the domain has been scanned by 91 security vendors, none of which have raised a detection at the time of writing; this absence of detections does not constitute evidence of benign intent. Public records provide no additional context such as hosting ASN, geographic location, or associated branding, and no page‑level analysis has been performed, leaving the exact credential‑harvesting payload unknown. Given the active resolution and the phishing classification, the infrastructure should be considered hostile. Defensive teams are advised to add rainbet.de and its resolved IP address 185.104.28.238 to block lists, monitor DNS queries for the associated name servers, and consider sinkholing the domain if possible. Continuous re‑evaluation is recommended as additional indicators may emerge.