rainbet-espana[.]com

Analysis Date: July 22, 2026. The domain rainbet-espana.com is currently active and has been classified as a high‑risk generic phishing operation. The domain was registered on February 27, 2026 through Dynadot Inc and uses Cloudflare nameservers nile.ns.cloudflare.com and roxy.ns.cloudflare.com. DNS resolution points to the IP address 104.21.9.24, which is hosted on Cloudflare's edge network. VirusTotal has recorded four detections out of ninety‑five scanned security vendors, indicating that a minority of scanners have identified malicious behavior. The domain is listed on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its reputation as a phishing source.

No public information about SSL certificate details, HTTP response codes, page title, or specific brand impersonation has been disclosed, so the exact content served by the site remains unverified. The lack of visible page metadata limits attribution of the phishing kit or targeted brand. The risk rating assigned as high reflects the combination of recent creation, active status, and confirmed detections. Although only four vendors flagged the domain, the presence on multiple blocklists suggests coordinated abuse. The Cloudflare edge IP 104.21.9.24 is shared with other unrelated sites, which may provide some level of anonymity for the operators.

Given the observable infrastructure, defenders should treat any traffic to rainbet-espana.com as malicious. Recommended actions include adding the domain and its resolving IP to network firewalls, DNS filtering solutions, and endpoint security blocklists. Continuous monitoring of the IP address for any changes in hosting or additional malicious activity is advised. Organizations should also ensure internal DNS resolvers do not cache the domain and enforce strict outbound filtering to prevent credential leakage. Sharing observed indicators with threat‑intelligence communities will improve collective detection.