rainbetgermany[.]de

Analysis of rainbetgermany.de, observed on July 22, 2026, indicates an active high‑risk generic phishing campaign. The domain resolves to the Cloudflare‑hosted address 172.67.199.227 and is served by the nameservers braden.ns.cloudflare.com and janet.ns.cloudflare.com, confirming its reliance on a widely used CDN infrastructure. Independent blocklists have listed the domain on three separate security feeds, and it is currently blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that multiple defensive platforms have recognized it as malicious.

A VirusTotal assessment involving 95 scanning engines reported no positive detections; however, the absence of detections does not imply safety and should be interpreted as a limitation of current signatures. The domain appears on three additional blocklists, reinforcing the consensus that it is associated with phishing activity.

Given its active status, high risk rating, and the presence of blocking actions across several security products, defenders should enforce network‑level deny rules for rainbetgermany.de, monitor outbound connections to its IP address, and ensure that endpoint protection solutions retain the domain in their block lists. Continuous re‑evaluation is advised, as the underlying infrastructure could be repurposed or altered without notice.