rain-buy-and-sell-bitcoin[.]apk[.]cafe

rain-buy-and-sell-bitcoin.apk.cafe was observed resolving to the IPv4 address 193.42.111.101. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy filtering service. A VirusTotal analysis performed on the domain involved 95 independent scanning engines; at the time of the scan none reported a detection. The lack of detections does not constitute evidence of benign behavior, but it indicates that no known signatures have yet identified malicious payloads associated with the domain. The domain’s authoritative name server information could not be retrieved (NS_NOT_FOUND), limiting visibility into registration details and potential ownership. No additional intelligence such as Safe Browsing verdicts, Open Threat Exchange reports, registrar data, SSL certificate information, HTTP response codes, or trust‑score metrics is currently available. Consequently, the operational status of the site remains active, and the specific content served by the web server has not been captured. The classification as a generic phishing campaign is based on the naming pattern and the presence on a phishing‑focused blocklist. Because the domain's registration data is unavailable, attribution to a specific actor cannot be established. The absence of SSL/TLS details means that any transport‑layer encryption cannot be assessed, and the HTTP status code returned by the server is unknown. Defenders should continue to monitor DNS resolutions to 193.42.111.101, enforce existing PhishDestroy blocks, and consider adding the domain to local deny lists. Additional analysis, including HTTP content retrieval and TLS inspection, is recommended to confirm the presence of credential‑harvesting pages or other malicious functionality. Threat intelligence consumers should treat the domain as suspicious pending further investigation and incorporate it into automated phishing detection rules where feasible.