rain-bet[.]net[.]co

rain-bet.net.co is flagged as a high‑risk generic phishing domain. The domain was registered through Dynadot Inc on 2025-12-07 and is hosted on Cloudflare infrastructure, using the nameservers archer.ns.cloudflare.com and gina.ns.cloudflare.com. DNS resolution points to the IP address 172.67.168.130, which belongs to Cloudflare’s network. The domain appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple protective services have identified it as malicious. VirusTotal analysis shows that three out of ninety‑five scanned security vendors have raised detections for the domain, reinforcing the suspicion of malicious intent.

The current status remains active, indicating that the domain continues to resolve and potentially serve phishing content. No public evidence regarding the site’s SSL certificate, HTTP response codes, page title, or content has been disclosed, so the exact nature of the phishing payload cannot be verified at this time. Similarly, there are no known references in open threat‑exchange platforms such as OTX, and no Safe Browsing verdicts are documented. The lack of additional telemetry leaves uncertainty around the specific campaigns or victim profiles targeted by this infrastructure.

Given the observable indicators—recent registration, Cloudflare hosting, presence on multiple blocklists, and vendor detections—defenders should block rain-bet.net.co at the DNS, firewall, and proxy layers. Security operations should monitor DNS queries for the domain and its associated IP address, and consider adding the IP to any existing network‑level deny lists. Incident response teams should treat any traffic to this domain as potentially malicious and investigate related authentication attempts or credential submissions. Ongoing collection of URL snapshots and HTTP headers is recommended to enrich future analyses and to confirm whether the domain begins serving active phishing pages.