rain-bet[.]es

On August 06, 2026 the domain rain-bet.es was observed as an active generic phishing infrastructure. The domain resolves to the IP address 172.67.140.209 and is served through Cloudflare, using the authoritative name servers pam.ns.cloudflare.com and sterling.ns.cloudflare.com. VirusTotal records indicate that the domain has been scanned by 91 security vendors; at the time of analysis no vendor has raised a detection flag.

The domain is listed on a single external security blocklist and is explicitly blocked by the PhishDestroy mitigation service, confirming that at least one downstream provider has deemed the host malicious. No public page title, SSL certificate details, or HTTP response codes are available in the current intelligence set, so the precise content and landing page characteristics remain unverified. The lack of detection flags does not imply safety, and the presence on a blocklist together with active blocking by PhishDestroy suggests a credible phishing threat.

Defenders should treat rain-bet.es as hostile, enforce DNS or firewall deny rules, and incorporate the domain into internal blocklist feeds. Continuous monitoring of the IP address 172.67.140.209 for changes in reputation, as well as periodic re‑scans on VirusTotal and other sandbox services, is recommended to capture any evolution of the payload or hosting profile. Sharing this indicator with threat‑sharing communities will improve collective visibility and expedite downstream remediation.