rainbet-24[.]net

Analysis of rainbet-24.net shows an infrastructure typical of a short‑lived malicious site. The domain was registered on December 07, 2025 through DYNADOT LLC and is served by Cloudflare’s DNS infrastructure, using the name servers kipp.ns.cloudflare.com and lola.ns.cloudflare.com. DNS resolution points to the IP address 172.67.173.214, a Cloudflare edge node that masks the underlying hosting provider, a common tactic to evade attribution.

The domain appears on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple threat‑intel feeds have identified it as hostile. VirusTotal reports that the domain has been scanned by 91 AV engines with no current flags; this lack of detections does not confirm benign intent, as many phishing sites evade static analysis. The domain remains active as of the report date (July 22, 2026), and its continued resolution to a Cloudflare address suggests the operators can quickly redeploy or modify content.

Defenders should add rainbet-24.net to network‑level deny lists, enforce DNS‑based blocking, and monitor for any downstream traffic to the associated IP. Because the hosting is abstracted behind Cloudflare, rapid takedown may be limited; however, reporting the domain to the registrar and to Cloudflare abuse channels can accelerate remediation. Continuous re‑scanning and threat‑intel correlation are recommended to detect any evolution in payload or infrastructure.