rainbetlegal[.]com

The domain rainbetlegal.com was registered on May 20, 2026 through URL SOLUTIONS INC. and is currently active. It appears on three public security blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL. The site is classified as a high‑risk generic phishing operation that impersonates a legitimate cryptocurrency platform, as indicated by the page title “Rainbet | Completely Legal Crypto Plarform.”

Infrastructure analysis shows the domain resolves to IP address 103.217.252.135, which geolocates to the Netherlands and is hosted by HostUS Solutions LLC. The authoritative name servers are ns1.pananames.com through ns4.pananames.com, and the MX record points to mail.rainbetlegal.com with priority 10. The web server runs Nginx with HTTP 200 responses, and the site stack includes WordPress, MySQL, PHP, Yoast SEO, and HSTS. The TLS certificate is issued by Let’s Encrypt and is currently valid.

Threat intelligence corroborates the malicious intent. AlienVault OTX lists the domain in four separate pulses, and VirusTotal reports five out of ninety‑five scanners flagging the site as malicious. The Gridinsoft trust score is 0/100, reinforcing the low reputation. The combination of blocklist inclusion, multiple security vendor detections, and the impersonation of a crypto service aligns with the observed generic phishing pattern.

Defenders should add rainbetlegal.com to network and email block lists, enforce DNS sink‑hole policies, and monitor outbound connections to the associated IP range. Security appliances should be configured to inspect TLS traffic to detect the Let’s Encrypt certificate used by the site. Continuous monitoring of the identified name servers and MX host is advised to capture any future changes or additional payload delivery attempts.