eng-us-rainbet[.]com

eng-us-rainbet.com is observed as an active generic phishing infrastructure. The domain was registered on 7 May 2026 through REGISTER S.P.A. and is served by the parking name servers aurora.dns-parking.com and nebula.dns-parking.com. DNS resolution points to the single IPv4 address 84.32.84.128, which is the only host currently associated with the domain. The modest age of the domain, combined with the use of parking name servers, is consistent with rapid‑deployment phishing campaigns that rely on short‑lived domains to evade reputation accrual. VirusTotal analysis shows that one of ninety‑one security scanners flagged the domain, indicating at least one detection but providing no further detail on the nature of the payload. No additional intelligence such as observed malicious payloads, phishing landing pages, or victim reports is publicly available, leaving the exact targeting vector and credential‑harvesting mechanisms uncertain. Nevertheless, the combination of a newly created domain, a dedicated IP address, and a positive detection suggests a non‑trivial risk to users who may receive emails referencing the “eng‑us‑rainbet” pattern. Defensive operators should consider immediate containment actions: add the domain and its resolving IP to block lists, monitor network traffic for outbound connections to 84.32.84.128, and instrument email gateways to flag messages containing the domain or similar linguistic patterns. Continued passive DNS surveillance is recommended to detect any future redeployment of the IP address or related domains that may share the same registrar or name‑server configuration.