rain-one[.]xyz

Analysis confirms that rain-one.xyz was registered on March 05, 2026 through OwnRegistrar, Inc. The domain resolves to the public IPv4 address 162.245.237.212 and is currently reachable, indicating an active infrastructure. DNS resolution is served by dns1.webproserver.com and dns2.webproserver.com, which aligns with the hosting pattern observed for other recent phishing infrastructure. The domain appears on four independent security blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL, demonstrating that multiple threat‑intelligence feeds have identified it as malicious.

VirusTotal scans show that three of ninety‑one scanned security vendors flagged the domain, providing additional corroboration of its malicious nature. The threat type is classified as generic phishing, and the risk level is high. No further public evidence such as page title, SSL certificate details, or HTTP response codes is available at this time, leaving the exact payload or targeted brand undefined.

The convergence of blocklist listings, vendor detections, and active DNS resolution suggests a coordinated campaign rather than a one‑off test. Defenders should immediately add rain-one.xyz to outbound and inbound filtering rules, enforce DNS sinkholing where possible, and monitor network traffic for connections to 162.245.237.212. Continuous re‑evaluation is advised, as additional indicators may emerge if the site begins serving malicious content or changes its hosting configuration.