rainbetonline[.]ru

This domain is flagged as a high-risk generic phishing site. It was registered on February 13, 2026 through REGRU-RU and remains active as of the report date of July 22, 2026. The domain resolves to IP address 188.214.30.6 and uses Cloudflare nameservers (emma.ns.cloudflare.com and weston.ns.cloudflare.com). It currently appears on three security blocklists: PhishDestroy, MetaMask, and SEAL, indicating recognized malicious activity.

Despite being scanned by 95 vendors on VirusTotal, none have flagged it as malicious; however, this absence of detections does not confirm the domain is safe, as phishing sites can evade detection. The exact nature of the phishing operation (e.g., brand impersonation or credential harvesting) is not specified in available intelligence, and the page content has not been analysed. Defenders should treat this domain as actively hostile.

Recommended actions include blocking DNS resolution and HTTP/HTTPS traffic to rainbetonline.ru at network boundary devices, adding the domain to blocklists in email security gateways, and monitoring for any outbound connections to 188.214.30.6. While VirusTotal shows no current detections, the domain's presence on multiple threat-blocking lists warrants immediate restriction. No ASN, hosting provider, page title, SSL certificate details, or HTTP status codes are available in the intelligence data, so further investigation through direct access or sandbox analysis is advised to determine the specific phishing method.