rainbet-us[.]com

Analysis as of July 28, 2026 confirms that rainbet-us.com remains an active malicious infrastructure used for credential harvesting. The domain was registered on March 12, 2026 through DEVEXPANSE LTD d/b/a Regery.com and resolves to the IP address 104.21.13.239, which is hosted on Cloudflare’s network as indicated by the authoritative nameservers gabriella.ns.cloudflare.com and ignacio.ns.cloudflare.com. The site is listed on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that multiple defensive platforms have identified it as hostile.

VirusTotal scans show that five out of ninety‑one security vendors have flagged the domain, reinforcing the suspicion of malicious intent. The current threat classification is generic phishing, and the risk level has been assigned as high due to the combination of recent registration, active hosting, and multiple blocklist entries. Defenders should prioritize adding rainbet-us.com to inbound and outbound filtering rules, enforce DNS sinkholing where possible, and monitor network traffic for connections to the IP 104.21.13.239.

Continuous re‑scanning with sandbox and URL reputation services is advised to capture any evolution in payload or technique. Organizations using email security gateways should ensure that any messages containing links to this domain are quarantined or dropped, and incident response teams should be prepared to investigate potential credential compromise should users report exposure. The lack of publicly available page title or content analysis means that further contextual intelligence may emerge, but the existing indicators already justify immediate mitigation actions.