rainbetonline[.]at

rainbetonline.at was observed as an active generic phishing infrastructure on 15 July 2026. The domain is registered through Hosting concepts B.V. via the .at registry (Registrar ID 648) and is delegated to the Cloudflare name servers byron.ns.cloudflare.com and stevie.ns.cloudflare.com. DNS resolution returns the address 172.67.153.177, which is part of Cloudflare’s content‑delivery network. A recent VirusTotal scan recorded a single positive detection out of 91 security vendors, indicating that at least one scanner identified malicious characteristics. No additional public indicators such as payload samples, landing‑page screenshots, or targeted brand information have been released, so the precise phishing lure remains unknown. The limited detection history combined with the active status and high risk rating suggests that the domain should be treated as a live threat. Defenders are advised to block both the domain and its resolved IP at network perimeters, monitor for outbound connections to the same address, and update detection signatures to include the observed nameserver pattern. Continuous re‑evaluation is recommended as further intelligence becomes available.