rainbetlt[.]com

Analysis of rainbetlt.com indicates an active generic phishing infrastructure targeting users with a short‑lived domain. The domain was registered on February 27, 2026 through Dynadot Inc and is hosted on Cloudflare’s network, resolving to IP address 172.67.147.210. Its authoritative nameservers are fay.ns.cloudflare.com and kellen.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services.

The domain appears on three public security blocklists, including PhishDestroy, MetaMask, and SEAL, and is currently listed as blocked by those services. VirusTotal has recorded scans from 95 security vendors, none of which produced a detection at the time of analysis; the report notes that the absence of detections does not constitute evidence of safety. No additional intelligence such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, OTX references, page title, or evidence URLs has been provided, leaving those aspects unverified.

Given the recent registration date, the Cloudflare hosting, and the presence on multiple blocklists, defenders should treat rainbetlt.com as a high‑risk phishing vector. Recommended mitigation steps include adding the domain and its resolved IP address to network‑level deny lists, updating endpoint protection signatures to include the observed blocklist entries, and monitoring DNS traffic for queries to the associated Cloudflare nameservers. Continuous re‑evaluation is advised, as the lack of publicly available page content or SSL metadata means further malicious capabilities could emerge without notice.