rainbet-sweden[.]com

Analysis of rainbet-sweden.com as of August 07, 2026, confirms an active phishing domain targeting cryptocurrency betting users. The domain is flagged by three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL, indicating a coordinated detection effort by specialized anti-fraud tools. Infrastructure analysis reveals the domain resolves to IP address 172.67.215.51, which is associated with Cloudflare's network, a common hosting choice for phishing sites due to its proxy services and ease of setup. VirusTotal data shows 1 of 91 security vendors has detected the domain, a low but non-zero detection rate that suggests emerging recognition of the threat.

The domain's registration and hosting details remain unconfirmed in the available intelligence, limiting further attribution. No page title, brand target, or phishing kit details are provided, so the exact content or mimicked platform is not yet analysed. However, the presence of MetaMask in the blocking vendors strongly implies a focus on cryptocurrency-related fraud, likely attempting to harvest wallet credentials or deceive users into transferring funds.

Defenders should treat this domain as an elevated-risk threat, particularly for users engaging with crypto betting services. Immediate action includes blacklisting the domain and IP, monitoring for related infrastructure (e.g., subdomains or newly registered lookalike domains), and alerting users to avoid interaction. Further investigation into the domain's WHOIS records and SSL certificate may reveal additional indicators of compromise or links to broader phishing campaigns.