{"report_id":"1762a66d-1c32-4e86-81a0-9539cafd733d","version":0,"status":"done","tags":[],"date":"2026-07-22T10:52:09Z","url":{"schema":"http","addr":"rainbetlegit.com","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":0,"asn":0,"as":"","country":"Australia","country_code":"AU"},"final":{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"title":"RainBet™ Sweden – Officiell Krypto \u0026 Sportsbook 2026","dom":{"size":264134,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (8672)","md5":"33b3266f0152fce5f9f256d285049eb8","sha1":"494116dcceb6f402a7868b52763f2f687e8f81cd","sha256":"40f2f554a0efceed1f78edbbe17a70c13704874012a93140c0f88c6db3692702","sha512":"cf0d0b9ceb54196e363b3c1e894e6c760dc3ee63103f08a301f2ebdd48eef2a86d71799441884fb9afb20dfeb1b6b0f9933e1ec74af5d55d11c3342d363ed10b","ssdeep":"3072:W5cOa26pPuADpUlBEcwsRChgGBOS9jk7q8o:WE26oADpUl/HI","tlshash":"8644fa5b56a72059353bb27c5fa9370d226dd013ca05cdf8baded148cfc9a9089b2b4c","dom_hash":"domhashe27323ae71cf00bd714f60eab3d0be62","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rainbetlegit.com","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":0,"asn":0,"as":"","country":"Australia","country_code":"AU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-26T10:52:09Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"rainbetlegit.com","ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"domain_registered":"2026-07-03","domain_rank":0,"first_seen":"2026-07-22T10:08:02.494315Z","last_seen":"2026-07-22T10:08:02.494316Z","alert_count":104,"request_count":52,"received_data":1894731,"sent_data":29066,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Polylang","description":"Polylang is a WordPress plugin which allows you to create multilingual WordPress site.","website":"https://wordpress.org/plugins/polylang","common_platform_enumeration":"","icon":"Polylang.svg","categories":["WordPress plugins","Translation"]},{"name":"Contact Form 7","description":"Contact Form 7 is an WordPress plugin which can manage multiple contact forms. The form supports Ajax-powered submitting, CAPTCHA, Akismet spam filtering.","website":"https://contactform7.com","common_platform_enumeration":"","icon":"Contact Form 7.png","categories":["WordPress plugins","Form builders"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"Yoast SEO:25.9","description":"Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.","website":"https://yoast.com/wordpress/plugins/seo/","common_platform_enumeration":"","icon":"Yoast SEO.png","categories":["SEO","WordPress plugins"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"Complianz","description":"Complianz is a GDPR/CCPA Cookie Consent plugin that supports GDPR, DSGVO, CCPA and PIPEDA with a conditional Cookie Notice and customized Cookie Policy based on the results of the built-in Cookie Scan.","website":"https://complianz.io","common_platform_enumeration":"","icon":"Complianz.png","categories":["A/B Testing","Cookie compliance","WordPress plugins"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-07-19T22:43:25.336158Z","alert_count":0,"request_count":1,"received_data":60298,"sent_data":526,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"g10102301085.co","ip":{"addr":"34.120.31.228","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2020-07-22","domain_rank":72137,"first_seen":"2021-08-03T12:42:57Z","last_seen":"2026-07-15T23:35:21.267005Z","alert_count":0,"request_count":1,"received_data":779,"sent_data":522,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"2e88a401907300a9989966839f7ab52d","sha1":"c15dcbe7b4ab3c929d4caa40438bbd384babcf11","sha256":"1320fe8c1f2515e760ba2b7347b1c6b4ad4f1f81e268099beb8b0b9e30cb9794","sha512":"49c9fc5c37a593f329bb646f7a7b53407fe1a05f5e43d91e0adecec646734c22a0bc32b0bb69ac87108a379fca06a89a18c0f5c208dce06471aa8cedf7a8ebb9","ssdeep":"","tlshash":"dd01abc9b9d17914259f616c21ab611e7573b5013e0c0ef3d46556922e30686d23e1ce","size":829,"data":"","first_seen":"2026-07-08T11:52:31.647944Z","last_seen":"2026-07-22T10:52:12.484619Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"3b4197ca8961c6575d40cd85e5248895","sha1":"d595e0575675670719a91903faa70b36fbbacad5","sha256":"8df316ee2087bd1ebd549fadcd0b69e6e0d58e0b3a5113d0fa54145ee049eaa4","sha512":"701bcf3714a53dcf3bee56f4fdab4c97cecb65d38652f6f447df7aa533ac6fa93684bf7aaec19a8ac5d8a469bbba4e9cee95b904c2f36d557dcdd2178b4d60f5","ssdeep":"","tlshash":"72e012bda9e154f0026bb1191a6fd620297204c7a4c49e047e5c4e5d1fa445c97e1a55","size":346,"data":"","first_seen":"2026-06-07T17:05:58.283171Z","last_seen":"2026-07-22T10:52:12.485375Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"7335be571d1f9586a0cf2f6952c4eec4","sha1":"f3b60c35f4f7b75ceb1266dbda8ac8d4b1ef11ce","sha256":"da1bed209470750a6c89d8f016d11e981ac975127f5db25aaf094404ecbec64f","sha512":"cebaf60fe3f7c0353c89f2de080ab49e6a5fd65040c113ae0d46f9b10f4b991b00bb15d61e287a60fe714a03569ee0fba4247de1acba85fd8ce02484aca505c1","ssdeep":"","tlshash":"91411868dbbe7662832ea0b62bfe52de143e547e7a814ebb7c38405048f48493715c7d","size":1934,"data":"","first_seen":"2026-06-10T08:18:22.002783Z","last_seen":"2026-07-22T10:52:12.487916Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"a9e76c57e7d8f6206977f40901c102fb","sha1":"461f9a046af8fd0b36977a63b44f59e6cebccf61","sha256":"448c8218627802c696ce69f7851f02254455c289182cef8ff9b533c2cbf2ac66","sha512":"5206003d360ac49c465c3ffef2ff0559b144b5f63a1d1166ee686f2a62afaf9c0c89f34da2b4f7a265e6088c259a4e694379348b7eab35378584cb787ccc7290","ssdeep":"","tlshash":"4f41fd31f37d253147bf64b529e5269e2a3990823e878ca6cc9c9c0524c1f5d4875cfe","size":1915,"data":"","first_seen":"2026-07-22T10:08:06.684621Z","last_seen":"2026-07-22T10:52:12.488689Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"fa9a2e00541c5d978bbf0a6222ba76b6","sha1":"e3bbc246c652e6594c458f3eaccf859d9397eccb","sha256":"5c3b561854db1a9db55f57069bf0ef0b5b12d741130b1114a18f4c65b1a7d381","sha512":"88f6ed907a6edcba1ac4e7446911ba0b3b9aeffa748363bb42a31676c5edb62755f25a9adc29f495db93a874641ce13dc1f4b461b8ee4dc541e5692d66dc1be5","ssdeep":"","tlshash":"3611ce28b6be043286637129266ef6cc7979006bac11cd0ebd2d8dc80fd0e519db6df1","size":1071,"data":"","first_seen":"2026-07-08T11:52:31.654177Z","last_seen":"2026-07-22T10:52:12.489403Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"e7c749255f0c7603b90f6196e3087ad6","sha1":"87ca6ed12bb4d899eb515fcbf1b06cd77bfecf35","sha256":"6c91320d2a35084146720e73b9eb506f8f042d304770136f76fdb279d3e82c90","sha512":"17c60dcf3f92c9719372b169ccdad70f329b88e816784043bc83bab6fae403aecab83deda08b8a8c2727ad201d11b2641646e45548d69e9accdadeb0566a3038","ssdeep":"","tlshash":"02b0128b74a73d50828fc7b44d23ba014510208782afc50875e59d3096718c0b4c352f","size":97,"data":"","first_seen":"2025-12-03T09:23:15.289558Z","last_seen":"2026-07-22T13:29:36.540533Z","times_seen":31399,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"af88d2da7f975da3370f5ebf3e291f3c","sha1":"ffcfeaa7015cf8210703c18dd0c4b5984099ffc4","sha256":"a76a02f6b8bad91436f9d88681c7490200969190ab32ccb418b6c8f530c5a424","sha512":"e2fe80f3cb7ab51e993c8e086a52d87c35de9897a638afafec7d9420da6a160337ec6a8283c7b1cbc44988d1c82a699a0cf8d01d004c2e5d59171ed3b847e52b","ssdeep":"","tlshash":"a401f4481cf8de26449262c939bf7649b17cf950936f6c03750e054e5b6197caaf374c","size":688,"data":"","first_seen":"2026-02-02T04:06:01.044192Z","last_seen":"2026-07-22T10:52:12.490825Z","times_seen":68,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"657dea7f1a57697cc61e5589ffd0aa79","sha1":"38321923c5ab480e257afc3933ec61b4e531554b","sha256":"f9409b4d5ddbab6af81c501e495cb8e86c9f124f4e9672b7f76447ba00923b11","sha512":"d0f9f3465295021a3398d5119079d44231ead2b97f69f35f522b10cb95c17f0baef162c75ca652e101823caf8f3115053874329c8e53a633792d3f9ace119e6e","ssdeep":"","tlshash":"05c0809994a81d4514eac15c017c131571189513cb1f5e55f24d004c9ff8079b9141c9","size":173,"data":"","first_seen":"2026-07-22T10:08:06.688734Z","last_seen":"2026-07-22T10:52:12.491579Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"6b153036a43fae30f9a272e9342290ed","sha1":"cf107f5346a6b34172909f57763ea28eeca41885","sha256":"dd903d4f070391d7e6fcc6aca23e31fb7448f3db0272dc64b32f2672ad2bdc07","sha512":"426d3373f4ff62d0ea174bf07657576710249acdbeef5ca7a782a5557e0a558d7b53f8d4e09ac1c455177b37cc8324d1cac683caf832e083a27f6b0d0c04b6b7","ssdeep":"","tlshash":"9fb0222a0ee02f0222a02eea0820823b22ac2020cc20ac0082cec880002ca82efcc208","size":122,"data":"","first_seen":"2026-07-22T10:08:06.69041Z","last_seen":"2026-07-22T10:52:12.492308Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"6e782184d1bed1de34118d1eead04029","sha1":"88eda2a5dad5c6d5f1c0c2619e6c4945be6da50c","sha256":"4b74ce357303ca19a24909ee9bb4e567d18c0218ff1022ae361b7ec4830e608f","sha512":"e87920db3f120ac45b4b45721c40fa23899ebe4cb9c401ed5b1527151546cd401b47615c3a69d214f581f8609dc68a2483dc977662a3cb5293473498e7a1d315","ssdeep":"","tlshash":"9821bb3b7e7c88ba47c473981694484f92dc5191d2a9855ce146ec38817c36bafeca07","size":1127,"data":"","first_seen":"2026-07-22T10:08:06.692377Z","last_seen":"2026-07-22T10:52:12.493278Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"fd29938f1ad524bd6ba87f4c0bdf291c","sha1":"ccce2f1c6e49b96f686e080b7b85695a08b0adba","sha256":"c98099d4cd33c13298dc59ce0c8cf912d68a0ab756ffe1fe733dd2b224f08106","sha512":"7a3a9237343dd8840f4d9788b4e88875c086b4ca6703759708bf9ae22e1d7d781eb0f9c96dda0d3d2d1b7a2ad3f2f73262ebf8c149440c5b4865e5cc2d5d803d","ssdeep":"","tlshash":"04f059db6b5c0432c25f305e105eb3cc3d7d803269412d67fc78c45248e0d98966289d","size":545,"data":"","first_seen":"2026-07-08T11:52:31.658162Z","last_seen":"2026-07-22T10:52:12.494352Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"6dbc1008a0655ecb932c1fde0eb72b0a","sha1":"2e64bf12bf7529f841baceb5ac9d5089ddfe9794","sha256":"2d65e312c8a0eed794d22cb196d1fabbf363edc0db34dc532345c58ade40c7aa","sha512":"312a05df4c4d92127ba8f16b8dbf05092762e348a050ea66d7821ce6b47f01415d89448a6e2d677e8167cfc76c0e282301761845405e54224c37be2933eac27e","ssdeep":"","tlshash":"d0216bd2f74c1532c4ff357eb45a42cc262d9071bc2018ba3d6c622c0172f8c55a679c","size":1378,"data":"","first_seen":"2026-07-08T11:52:31.658994Z","last_seen":"2026-07-22T10:52:12.495334Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-i18n-js-after","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"ee6e5684d2bc2cc9fc1dc1360c6851d6","sha1":"2f5a2613ea6546aeeae50176c5a1d7e85fe8f2ab","sha256":"7bdae2455b0f044dc7a158916de8d179a6a2a44d768d4022414c1fb8cc5eca9d","sha512":"979f777c5b9f990fb4f984ee42f9d8c04e5dc0a9c1cbb935b3b6511aa244bd5a98a505b0ef34dc097b996b33f942c61d3d04f2f6c38ec4b8e40086b522700705","ssdeep":"3:HaaUdLLxkFAhEK49MQGmVB4iFM/KGNVSJFo:6BLxTqtGmVOiFM/KGNMJ2","tlshash":"3fd112cbf4ab3d50828fc7b48d23be0145502487c2afd50875e59d3496718c0b4c362f","size":6181,"data":"","first_seen":"2026-07-22T10:08:06.702757Z","last_seen":"2026-07-22T10:52:12.496309Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/contact-form-7-js-translations","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"4a5c974d25132dcf219c231f3aac8314","sha1":"a82db2d128c9a4ce0d508a0d9339bca804f0e504","sha256":"0cefb38aafc8f84366987e0c6aaf58be01a240d323cfa2fef235cfae9d4ff4f7","sha512":"173c5adfea0ee8f532ae6b3ee610d0886a59be935782295a640ba2807da80a724ba4a8171be14d353494172b7633a11ddcde7d20befd77770a415981bd820839","ssdeep":"24:6q2WBWUcWLNVT7sJKcdSxHTDljcvHuc0ZSWv:92WBWUcWLrTY4cdEHTZFSWv","tlshash":"89e11544dcb8d915449252f539be76487038f550c36b6c02710e040e566156c95f374c","size":6777,"data":"","first_seen":"2026-07-22T10:08:06.697496Z","last_seen":"2026-07-22T10:52:12.497636Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/contact-form-7-js-before","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"8601a5160739ac86e764a53d30b2bf32","sha1":"64129cd6bc4aedd99203169568016fad4f9d5de3","sha256":"f5487235a7f2d3bfcd5820c5a394dd54ef79cb68cc76680a4f8bfa9924b6a9f1","sha512":"0fd5198eeb2c56ec9945ac9e0f9fe142c844582dce43e34ebd9665d8e541ccaa42d8bcf7007c498e5315b603ac658bf8aa0b8b0b03845ccc6407a8975f8639e9","ssdeep":"3:Hz6SVGDSiCmbFFlHrYLdjKBF/FFhhzVEGUHsR5pHdFQAwaKLlUFrQAv:nLiRhDmdW1ulgpwAwaKZ4rQAv","tlshash":"64d18099d5a81d4514eac17c057c1315b1189517cb1f5e55f24d404c9ff8079b9181c9","size":6270,"data":"","first_seen":"2026-07-22T10:08:06.695862Z","last_seen":"2026-07-22T10:52:12.49926Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/dist/js/scripts.min.js?v=1.2.5","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"5941c8cb55bde4b2cc24a6ed4ff08f1a","sha1":"6ae966638ac68880e24e46c9d66f4e54b2e902fe","sha256":"6c7214f211a09d913bf9d0ef5a2e420ea78d4275d15bfb6ed07661c12f1f7963","sha512":"489f44ac531a6876ab4220ad32cc9e1b2631767168d4d6b4d123accf36e7ee2bebf861d023494ea3210265ef8b1473893122500c603cceb0cdcd0a78e2bb9562","ssdeep":"192:ajmU5FJoVRReWlAWLAGw9rPBImzgcxh2xYRvGQORa20WGW/dc7yyj/qCho:OFJ+RDAGw9r0hJ7","tlshash":"5602535653b22c7d45736a195e7fae0679b880ab1d83e816380ff4804f784fa43b47e9","size":8485,"data":"","first_seen":"2026-05-02T07:09:17.931605Z","last_seen":"2026-07-22T10:52:12.453225Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/dist/js/header-search-logic.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"95a9aec3eec3385f61adaccf426e2fd3","sha1":"67e44e58f75a4514ba008c2ee3d5dcfd307c2a75","sha256":"52cd79f5c766b41f3be8b2c592ffa11eb63d657ea8c77b8d2be5875a2f98abe8","sha512":"a78a430b4249582e89a6da526bf80eec5e11991c0c780e248e53c3acb9b315b60bdd03082eeb146fd9d218cf61952ab5408afa40adba8081e03d1dfee3cca148","ssdeep":"","tlshash":"7511b4396128b439923b01c7d266afd53d59008ff840427966ac47ee2fc1ce3a3625fa","size":984,"data":"","first_seen":"2025-06-17T02:00:31.74037Z","last_seen":"2026-07-22T10:52:12.472275Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/contact-form-7/includes/swv/js/index.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"96e7dc3f0e8559e4a3f3ca40b17ab9c3","sha1":"d363d0291e92c233e828023583dcf6685f2da5a2","sha256":"29fdd17a7002a2e1bbd9b33adafc53457c64006b5aca8f6e4dbf907de35433ca","sha512":"851dcea59510a12dd72c8391a9ea6ffa96bcbe0f009037d7a0b6e27bae63a494709b6eee912b5ed8d25605fbb767a885f543915996f8a8aff34395992e3332dc","ssdeep":"384:wwuf8OQL0sARrAZcNWLq/+Ffm/hibLexa2VautyX2fsL3ZHO1O9H:wwuf8OQL0sAZAGNWmGcibLexa2Vau0XD","tlshash":"d34235e16197e0f0c7c338a48816c051f2bf866cb9898054fb5dcdd22d5de07626b77a","size":12512,"data":"","first_seen":"2025-03-11T19:47:45.42406Z","last_seen":"2026-07-22T13:28:03.797375Z","times_seen":218979,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/contact-form-7/includes/js/index.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"2912c657d0592cc532dff73d0d2ce7bb","sha1":"70a679e2769825236f83bcc56965a9d0bd86c4e9","sha256":"ddcce687729cb358abf9d0d8e1217a097859be2b0d18c23d7c851b38c87bc9c0","sha512":"9646384e65d09bf00cb20365f43e06dd41e7428e3fc6cc2737f4e69b50f006ebb25bd24a566fcd9faec2f0dcb24404e25d57ba7b8c6aba61797a29c515ad5144","ssdeep":"384:IsIRHeFJ1yQ7QdfnJgeYh7MXlsNqrBp1pgQpwOjNtqohIQ/5Z:IsIR+L1yQ7QdpYh7M1iqrBp1pgQpwOjn","tlshash":"0a52d7a1472955321eb506e391e513c1769075aef44b8aa1a898dc2e18bdcc328f3ff7","size":13452,"data":"","first_seen":"2024-11-04T17:50:00.022634Z","last_seen":"2026-07-22T13:28:03.754457Z","times_seen":226611,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/scripts-js-extra","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"e3cba0fa08cd628d99edb7b14b1a2f78","sha1":"216ee1ef1f98a5673e5a01f61d1c277e8a9444b8","sha256":"cc86f715ce33c2173cd3406816e59c92261499d04a247df80f93c753704b0ea9","sha512":"36af3e4c3995070ebb462842a70462a8aca8f0704e6c0ee61f5bd0017f127867d8b388a20e1eb9e1a453a821ede0273ff61c085691b3c0af3ce6459e8dd438da","ssdeep":"3:HD6EDew5vNVYLd2grTHnJH+LX/OtVKGY3r:/9xGd2grTQLXo4GY7","tlshash":"0cd12b16cdd01f0251901ef908204237129c2020cc60dc0042cec440006c541dfcc108","size":6229,"data":"","first_seen":"2026-07-22T10:08:06.69917Z","last_seen":"2026-07-22T10:52:12.500185Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-includes/js/dist/hooks.min.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"55c5129ccd0fa8f383d9de82a91c5877","sha1":"596918015fa62e4f18533b69b0e6822ebee3cb2d","sha256":"cce388fed1a82ebd20ce7d9601e4b6c83a425ea201c333d71b1183ee887cc090","sha512":"956ab39b4bc0577f0ac50a842bc7f71ac1d5b6f7148f9ba9bdb2a84001b96362f077d417144dce171464de8aac71ffd6e639e35ca12da4de2d12fddd660e64a3","ssdeep":"96:lu/16WIHBLusBcADGDd/R5h2RTLlD3jMXY2yGy94E34sTY2Cif:lGIhNBcAD0NRv8XlD3wXY2yH+EoaY2f","tlshash":"5ca151c43542b930e2b77027f0ab58d46175abe1a82d8446d59cd8f12da39cee0e7b3d","size":5050,"data":"","first_seen":"2026-07-02T22:01:42.321596Z","last_seen":"2026-07-22T13:29:36.485288Z","times_seen":8050,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-includes/js/dist/i18n.min.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"12ebec1b36678eb1da4412af6c65751a","sha1":"4cb5d87353d9a06fde067063787a4beed692ba77","sha256":"558ae0ec83cc88de0929fde86b87c231246aafa9c961ebffb3257b05f62ca5cf","sha512":"a1bbd93277a59086bf27da7dcc60434b717ac521bce0618aef7c914789497a22cf56441a7f300f1bb7a6de56ca624226883d048f6eadbcc049dc717338189bb6","ssdeep":"96:IE7/RPgrMs4WLJOmlWS33c0xyE2B1596NiH826V0NG7CXMGOyd/sEomkKvYCGaMe:3hgws4WTBYNB1C9aNwAMPyd0R3SGaMSL","tlshash":"fdc1a7c975daf056235910a594afb005e134be2870debc00aae0c4957eb44cdb2b7fba","size":5732,"data":"","first_seen":"2026-07-02T22:01:42.315643Z","last_seen":"2026-07-22T13:29:36.485865Z","times_seen":7875,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/cmplz-cookiebanner-js-extra","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"ccf6bd59ddcc02385367612e3d8785b1","sha1":"f44fbfa28a309ca1f0789f4a7feff920bf8e4065","sha256":"e37fa2f45177660797d86513d59be377c5aa2732287f30568ae67be59d2dcf47","sha512":"ef50ac8a7d8065da7d4bd39667a42b9fd1f63d2260bf55d391a4cc7a8bd5190124b7845160ccfc7a4800edadb1b41fe9eb72096644c994bec0df797faf11db40","ssdeep":"24:nRWNe+Xqyf+6GGaDeyQgiPqRKM9iAwYS8cAGFxEe3A3VO2:nRWOAeGBPPqRHPUFSnVO2","tlshash":"9fe19b3bfe7c84b946c463b81694484f92dc5191d2a98558e145ec28817c36bafe8607","size":7240,"data":"","first_seen":"2026-07-22T10:08:06.701013Z","last_seen":"2026-07-22T10:52:12.501052Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/simpletoc/assets/accordion.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"4440d679d097638af0608509e706e642","sha1":"c897ef6bce63b52372e28a415d6d49088108a662","sha256":"169f6f797ab62f0af18a12c81dbff9076ac66b441abdd296a2acda5bfbe200c7","sha512":"b7db759cc245eb52919e34f7e657af3147a6968c2ed5fd44e3cad970fe0b904db6bf185a3c2cb506d075a4a5f3f0a4f502ef55addca044b837789db63015a904","ssdeep":"","tlshash":"4af046b46b2c333647e9d0455c1626d6763cc006ea41a4eb0c14ccdd28c8ea469eb6f6","size":598,"data":"","first_seen":"2025-06-17T02:00:31.745723Z","last_seen":"2026-07-22T10:52:12.444015Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"087de03e5dc079a0742ac8478a5f8c87","sha1":"b14ad9cfa3fa6ae9381806189e7f35f543d185ed","sha256":"fe345dc92f2c901c2eccac134294ff2216e70177dd054ba6f104af6015959ee9","sha512":"5742b4c16babac5856080614523b47dff4f3dff7cc102a3a5474ab1e0c82de4a1e987327beb303775042727b35d3f2498f6916c6283117415725dce206c437ef","ssdeep":"768:k4cjy6JZaYSJjv+YfzwLpstNyuGFGgxesKNVhIkYJO2ybEXoHHFC1aRHQpmiVKbX:IZal8OHQpmZNemLECFKAJ","tlshash":"3903e8b93a9c90b416ee87ed37abab48e4303961dc0fc8609565dc542258dc70f9bfb1","size":40647,"data":"","first_seen":"2025-10-07T21:11:17.93794Z","last_seen":"2026-07-22T10:52:12.479453Z","times_seen":8169,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g10102301085.co/gr?id=-Nx8NDCxoi5XHExf6J3e\u0026refurl=\u0026winurl=https%3A%2F%2Frainbetlegit.com%2F","fqdn":"g10102301085.co","domain":"g10102301085.co","tld":"co"},"ip":{"addr":"34.120.31.228","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"76c7778e369c280777c7d8889a9a8e85","sha1":"f57a0a4c724f864c11faeab748e51a6a6e583609","sha256":"c5048d5003cbdfc61ecbba655e914de5c09f349d0d85306ef23f5e34e7e3acb3","sha512":"1fcdf37f78b33db612bc9f4159c8148e77bbf0e97b2b6b9f069fe738730e186bf3fed0d5b51bd9c90880d6bda7195416a2ed9dc02487ad202c3dd29ec508bf8d","ssdeep":"","tlshash":"70e026e8b6ea613050f766ac2212c42138736032334c18ebe860236a7ef011e811a7ff","size":352,"data":"","first_seen":"2025-08-13T16:04:47.939696Z","last_seen":"2026-07-22T10:52:12.480436Z","times_seen":22,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"opt-in","filename":"https://rainbetlegit.com/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js","line_number":1,"column_number":21068}]},"http":[{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/polylang-pro/vendor/wpsyntex/polylang/flags/se.png","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.065Z","timestamp":1784717502065,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/polylang-pro/vendor/wpsyntex/polylang/flags/se.png HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/png\r\ncontent-length: 248\r\nlast-modified: Wed, 22 Apr 2026 08:54:41 GMT\r\netag: \"69e88cd1-f8\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":248,"size_decoded":566,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit colormap, non-interlaced","md5":"af9b2179cbd6982c86ee0fe0c2d812bb","sha1":"ce02f96449a23b4128f687ba002510c982728189","sha256":"3ad72d04b863fc860a2f724f27820ad7b2699614a91dcd4c0bdd06f57685ec75","sha512":"bbc7447444cd2f1a907ea4a34e0b8560fa7daa5a3688d0f6e378def91156b8253fc7117567d60d6f52fad07e675cb5a42270c56005b2c82535d8abc5c43884f1","ssdeep":"","tlshash":"bed02ba7319228b8ee3ba1278840c123ad5a0a2484f12a070c04f35a6c8006c4405b80","first_seen":"2023-06-16T18:14:04Z","last_seen":"2026-07-22T10:52:12.432596Z","times_seen":76,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/contact-form-7/includes/js/index.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.079Z","timestamp":1784717502079,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/contact-form-7/includes/js/index.js HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Thu, 11 Sep 2025 10:01:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c29e10-348c\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13452,"size_decoded":4619,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (13452), with no line terminators","md5":"2912c657d0592cc532dff73d0d2ce7bb","sha1":"70a679e2769825236f83bcc56965a9d0bd86c4e9","sha256":"ddcce687729cb358abf9d0d8e1217a097859be2b0d18c23d7c851b38c87bc9c0","sha512":"9646384e65d09bf00cb20365f43e06dd41e7428e3fc6cc2737f4e69b50f006ebb25bd24a566fcd9faec2f0dcb24404e25d57ba7b8c6aba61797a29c515ad5144","ssdeep":"384:IsIRHeFJ1yQ7QdfnJgeYh7MXlsNqrBp1pgQpwOjNtqohIQ/5Z:IsIR+L1yQ7QdpYh7M1iqrBp1pgQpwOjn","tlshash":"0a52d7a1472955321eb506e391e513c1769075aef44b8aa1a898dc2e18bdcc328f3ff7","first_seen":"2024-11-04T17:50:00.022634Z","last_seen":"2026-07-22T13:28:03.754457Z","times_seen":226611,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/822c111c-69a1-4978-8284-4317ae125eee.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.126Z","timestamp":1784717502126,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/822c111c-69a1-4978-8284-4317ae125eee.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2080\r\nlast-modified: Wed, 19 Nov 2025 12:52:21 GMT\r\netag: \"691dbd85-820\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2080,"size_decoded":2401,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"25bd97ed63cfcab632649a9f1886b27b","sha1":"ae95f1d196dfa3c01032c49fc496c1ad1e1734c1","sha256":"0b4507801a93c0414ea01d747d4f56aa6c3bb6058def83fca97fd2c049d5477c","sha512":"78bcef71cc4576df1a6d70bc119c7aeed2aec94ccb3705006b246803ef3f2e29d77a7dcc496cad9e65f3ddf26335fbde21c17557feec24f2f2337f5a7bbb0623","ssdeep":"","tlshash":"3141ea56a779679fd4230fbc22c50f41c7d52366439495b0c70852716f992dc79ec4f2","first_seen":"2025-12-08T04:02:28.613589Z","last_seen":"2026-07-22T10:52:12.435557Z","times_seen":11,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/images/star-icon.svg","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.292Z","timestamp":1784717502292,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/star-icon.svg HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 282\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\netag: \"6a60670f-11a\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":282,"size_decoded":605,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"47d7d44c0e7cba35b9903fcf5056c2b0","sha1":"7396eebf4cd6481f68577c7ed618da3848c7dcf5","sha256":"e1b89f9939709042aeb824ac851db5b411a542f91f50d143d118f7f1b331897a","sha512":"477b9212fe22b98d53eb7b11c3d1f2382f042c4c534a0db74ac721edba0783a71ba546cc1035889b3998ebef7a658bbe24ce3a7c8abc32e5816d08ebb7a496d1","ssdeep":"","tlshash":"ffd02bfa50ace9064044c724337a6c3d31e730be08de110d69c2f1a1e5794d72e2c9d8","first_seen":"2025-06-17T02:00:31.751022Z","last_seen":"2026-07-22T10:52:12.436633Z","times_seen":114,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/84182e5f-bf10-4af9-bc9c-8a55ff649655.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.128Z","timestamp":1784717502128,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/84182e5f-bf10-4af9-bc9c-8a55ff649655.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2598\r\nlast-modified: Wed, 19 Nov 2025 12:52:22 GMT\r\netag: \"691dbd86-a26\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2598,"size_decoded":2919,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7a69313e28331ed4a0029c7cea05d82f","sha1":"bd7538d80e7246d6c41eef75ca8a539a345c4aa8","sha256":"c28b69fa77da238487da5eeaea9f36141f09a10e0598ad4298e2136872456624","sha512":"8daa63f76dee4f1a9eccbffdaa3fbf8252f1fb7f26e5a25b91ec80109bee1b0c8c37e42cdc8c61f012219f5d47fda052a19b080eb7d70e342914a215f9ab2833","ssdeep":"","tlshash":"0d510a5a77286b66c90213f920c0b3a6fbc83e578e83d95044c146846f66ad756ec44b","first_seen":"2025-12-08T04:02:28.672912Z","last_seen":"2026-07-22T10:52:12.437692Z","times_seen":11,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/74de2455-966c-47c3-84c7-7202b4acd950.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.134Z","timestamp":1784717502134,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/74de2455-966c-47c3-84c7-7202b4acd950.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 1674\r\nlast-modified: Wed, 19 Nov 2025 12:52:19 GMT\r\netag: \"691dbd83-68a\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1674,"size_decoded":1995,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cb744b64324949b5c5d2df2f7b141951","sha1":"b9bca1aad1c94ac40d60fdab1515537c26520184","sha256":"0f5d25b1df3bc12f960ebe7124c82f3b583232dd5d386911b5c1cdec9c82faec","sha512":"82250e10b04aeb461838e53fc1e84faa15e715abd2f56428ebcaf089a80b721c0fc6d349fb3863bab02709761bd7a60bc5141334508f64cca83582bf865a5df6","ssdeep":"","tlshash":"9931d76413b02b0be1527ffe00e35bc6829d1c10c69f9743e71a8a776724ae5298c75e","first_seen":"2025-12-08T04:02:28.60794Z","last_seen":"2026-07-22T10:52:12.438957Z","times_seen":11,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/images/icon-email.svg","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.291Z","timestamp":1784717502291,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/icon-email.svg HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 611\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\netag: \"6a60670f-263\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":611,"size_decoded":934,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a7175dab5aa6a0596cd216f0636a4ec2","sha1":"a21c67d4d3feb62eef9029cc24cab0b4d01ac665","sha256":"7fdde8a57a9525b48fbac613dbfcfbd0bd88651dccae976d382637a6b83306ac","sha512":"41d8bf0ee07374b8fde10493c14715c5491744eaafed644f4be15895236ff503bac0ed029a5647bfca2029186a77038de14b3231d31f4b2bff06302b21a04612","ssdeep":"","tlshash":"4af002d482ee1d91810bcf90b52b7d12f46721f91d3cc15c01a5a114f87c56f5c1c8f4","first_seen":"2025-06-17T02:00:31.748608Z","last_seen":"2026-07-22T10:52:12.440329Z","times_seen":15,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-regular.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.297Z","timestamp":1784717502297,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-regular.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19396\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\netag: \"6a60670f-4bc4\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19396,"size_decoded":19719,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19396, version 1.0","md5":"28ab3b0e8151123d4dc1d08197b61f8a","sha1":"7cb91342ce5dbc20a2378b5d5a85dea3f69467ea","sha256":"fbfb7cf0faeba70db28a9ed1a35b932b2a85bac25d27b1859befec067937393f","sha512":"12788bb3cea49ee0b3195d2e0588d7dfdb727a87592cc7772ccca81f4c58d9304f49d45347e9caad96334d451e17e4d4aeae98e1005d463aaf4870e34bc013e1","ssdeep":"384:xb6z6mPqSU/zTjdeJUlq/BJslogLFQ8oga3tkYb4GFD34QXCZigPBc8MU1L:xb6z9SrVil/glooFQ83aCYjSZiQmBGL","tlshash":"9c92d1d5936a5801fb730bf0119a94dbcb83136a0bf4b4e8818cd09bcb5f097417aaf6","first_seen":"2023-05-01T19:05:47Z","last_seen":"2026-07-22T10:52:12.441304Z","times_seen":151,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-500.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.626Z","timestamp":1784717502626,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-500.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv; c2_popup_unique_name=GVgRBVsdH1UdDFAMRVoXBg==\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19580\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\netag: \"6a60670f-4c7c\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19580,"size_decoded":19903,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19580, version 1.0","md5":"95c5b525d84aaf5a8411f6ae51916cfe","sha1":"426515e1c6be3e3b101c0c79f29741ea57cdb0ec","sha256":"01ffc8802167df3b7c029549092fd0aa9f0712e089ef4e26c543376de69faa91","sha512":"24907cb28e09ebc62f256916b1a104a53f53b4b284c78380ce450efde9081772bab7b1772dccc7c464e9be21ebd2ee8e023046714a047fd1973b68969bc90685","ssdeep":"384:q2wsotK+EWugFk5Ab1n1sHQySPOqTJ7BsARD5Wzxy7ZlcU+jXzauPc9m:GzlE6r0wtsALhjuWuYm","tlshash":"af92e1217443c4c9ee3d98f24e4fdf3481b8de1d097e21592ed24283ebe57449a3e945","first_seen":"2023-05-01T05:27:13Z","last_seen":"2026-07-22T10:52:12.442241Z","times_seen":180,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/contact-form-7/includes/swv/js/index.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.077Z","timestamp":1784717502077,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/contact-form-7/includes/swv/js/index.js HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Thu, 11 Sep 2025 10:01:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c29e10-30e0\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12512,"size_decoded":3857,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (12512), with no line terminators","md5":"96e7dc3f0e8559e4a3f3ca40b17ab9c3","sha1":"d363d0291e92c233e828023583dcf6685f2da5a2","sha256":"29fdd17a7002a2e1bbd9b33adafc53457c64006b5aca8f6e4dbf907de35433ca","sha512":"851dcea59510a12dd72c8391a9ea6ffa96bcbe0f009037d7a0b6e27bae63a494709b6eee912b5ed8d25605fbb767a885f543915996f8a8aff34395992e3332dc","ssdeep":"384:wwuf8OQL0sARrAZcNWLq/+Ffm/hibLexa2VautyX2fsL3ZHO1O9H:wwuf8OQL0sAZAGNWmGcibLexa2Vau0XD","tlshash":"d34235e16197e0f0c7c338a48816c051f2bf866cb9898054fb5dcdd22d5de07626b77a","first_seen":"2025-03-11T19:47:45.42406Z","last_seen":"2026-07-22T13:28:03.797375Z","times_seen":218979,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/simpletoc/assets/accordion.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.088Z","timestamp":1784717502088,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/simpletoc/assets/accordion.js HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 598\r\nlast-modified: Wed, 03 Apr 2024 22:09:28 GMT\r\netag: \"660dd398-256\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":598,"size_decoded":945,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"4440d679d097638af0608509e706e642","sha1":"c897ef6bce63b52372e28a415d6d49088108a662","sha256":"169f6f797ab62f0af18a12c81dbff9076ac66b441abdd296a2acda5bfbe200c7","sha512":"b7db759cc245eb52919e34f7e657af3147a6968c2ed5fd44e3cad970fe0b904db6bf185a3c2cb506d075a4a5f3f0a4f502ef55addca044b837789db63015a904","ssdeep":"","tlshash":"4af046b46b2c333647e9d0455c1626d6763cc006ea41a4eb0c14ccdd28c8ea469eb6f6","first_seen":"2025-06-17T02:00:31.745723Z","last_seen":"2026-07-22T10:52:12.444015Z","times_seen":43,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-22T10:51:40.235Z","timestamp":1784717500235,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:41 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nset-cookie: pll_language=sv; expires=Thu, 22-Jul-2027 10:51:41 GMT; Max-Age=31536000; path=/; secure; SameSite=Lax\r\nlink: \u003chttps://rainbetlegit.com/wp-json/\u003e; rel=\"https://api.w.org/\", \u003chttps://rainbetlegit.com/wp-json/wp/v2/pages/2\u003e; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\", \u003chttps://rainbetlegit.com/\u003e; rel=shortlink\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Polylang","description":"Polylang is a WordPress plugin which allows you to create multilingual WordPress site.","website":"https://wordpress.org/plugins/polylang","common_platform_enumeration":"","icon":"Polylang.svg","categories":["WordPress plugins","Translation"]},{"name":"Contact Form 7","description":"Contact Form 7 is an WordPress plugin which can manage multiple contact forms. The form supports Ajax-powered submitting, CAPTCHA, Akismet spam filtering.","website":"https://contactform7.com","common_platform_enumeration":"","icon":"Contact Form 7.png","categories":["WordPress plugins","Form builders"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"Yoast SEO:25.9","description":"Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.","website":"https://yoast.com/wordpress/plugins/seo/","common_platform_enumeration":"","icon":"Yoast SEO.png","categories":["SEO","WordPress plugins"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"Complianz","description":"Complianz is a GDPR/CCPA Cookie Consent plugin that supports GDPR, DSGVO, CCPA and PIPEDA with a conditional Cookie Notice and customized Cookie Policy based on the results of the built-in Cookie Scan.","website":"https://complianz.io","common_platform_enumeration":"","icon":"Complianz.png","categories":["A/B Testing","Cookie compliance","WordPress plugins"]}],"data":{"size":267565,"size_decoded":47241,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (8838)","md5":"568b6c80d7342926965337ed56a0b7b3","sha1":"06487e4d08533fdc3cb4877989a8c26b5b25c557","sha256":"979d10e5a169bac4fb65e18b643ba0d49fc3f0470af72ae6175ae54a7ff2584f","sha512":"4a79296d7d48b4dbf61b7e20ecfe8895cd898720f8d9e55ede1340cbeb61b8632495f8fb25964ba45e9ef0997f9b13d9cb80794c662d7984913156d57d666a2f","ssdeep":"3072:H5POp26pPGADp+DFjNo5fhgGBOS9jk7q9M:HM26cADp+DHt","tlshash":"e444f95b56a72059393b727c5fa9370c626d9013ca05cdf8baded148cfc9a9089b3b4c","first_seen":"2026-07-22T10:52:12.445432Z","last_seen":"2026-07-22T10:52:12.445432Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1253,"timings":{"blocked":-1,"dns":4,"connect":16,"send":0,"wait":1207,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/menu-image/includes/css/menu-image.css","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:41.737Z","timestamp":1784717501737,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/menu-image/includes/css/menu-image.css HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:41 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 11 Sep 2025 10:01:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c29df0-d0f\"\r\nexpires: Fri, 21 Aug 2026 10:51:41 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3343,"size_decoded":1149,"mime_type":"text/css","magic":"ASCII text","md5":"0546e1ffbf7dca6915124f9228e73abe","sha1":"6782f77c395c339354e43260f2976edebe1b25d1","sha256":"75db663f63c3505c2d1d2c41b82da41465bcd39b390516728f7fd323f95f644e","sha512":"08744d582f9c72fdb74dad04593cafacfb692372a58ffd97d78f20ded7966965abe04263a02923925a0e00b14b8c9cbc313d38109fdee4211c4966e74dea518e","ssdeep":"","tlshash":"0f61bac68a6b2432490293a87a8fd3f52b790c239fc6db8477b55918cb49570c2f3275","first_seen":"2023-04-05T15:56:37Z","last_seen":"2026-07-22T10:52:12.448657Z","times_seen":4517,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.033Z","timestamp":1784717502033,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/font-awesome/5.15.4/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 10462\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 13 Sep 2021 19:10:03 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mXZV38IZLqxYGr1xRixi%2FAmki6%2BizEO55lGHWUOUy9awTm6lkRCzJWlqFswXsvA9pXdxnLI5rHceG6M1skVGko3tpLu0CZjH791uMd8LQDhkbKa9Jbd%2B%2Bmw27sqx3sU9I07k8aIF\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-ray: a1f1e443cb3f5699-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":59305,"size_decoded":11455,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (59119)","md5":"ecd507b3125edc4d2a03aa6ae5d07da9","sha1":"a57ee68d11601b0fd8e5037fc241ff65a754473c","sha256":"99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e","sha512":"d72727e8871a410e34fcc2815b65b84618acfc36c82d4ef80b5bd2acb2710aae7ba3de35626d354b036c38caaf10116572051aeb12e23d8fcd4b947e13aced25","ssdeep":"768:PEh31IPiyXNq4YxBowbgJlkwF//zMQyYJYX9Bf7VSzl:PE0PxXE4YXJgndFTfy9lQB","tlshash":"8c43fbb8e54c01cab731c44bef81b2bc61b6f73de5914d95f00e691c2ad26a811c5fba","first_seen":"2023-03-13T09:02:16Z","last_seen":"2026-07-22T13:41:34.11309Z","times_seen":46448,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":3,"connect":15,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/images/rating/badge-1.svg","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.102Z","timestamp":1784717502102,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/rating/badge-1.svg HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a60670f-5fe\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1534,"size_decoded":1076,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"64a832d2a41fe3c9035f305366cd00b0","sha1":"75abbc24c6efd1bf1cf81332b149a7fbf059a609","sha256":"889ee0275f0ebef2da49a348e54930f4e1661afaf111b8f25102aa9352788c0e","sha512":"da758f48497427d11d4f77cab781459a8fd6191731aa1ce2dacd0a0af4c48ba2f265f4b7109bda3f653d1c9eac13d56c93dd05bb963666b4a0e5adaf3eb3c612","ssdeep":"","tlshash":"6131957ea10d2c2af12885bc9e12c4791476bcf70cc2100146e1b9abe0a74c60ceaa5f","first_seen":"2025-06-05T18:04:56.815714Z","last_seen":"2026-07-22T10:52:12.450548Z","times_seen":58,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/786f77e6-02a2-4626-9846-d040bdd0f0f3.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.125Z","timestamp":1784717502125,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/786f77e6-02a2-4626-9846-d040bdd0f0f3.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2688\r\nlast-modified: Wed, 19 Nov 2025 12:52:20 GMT\r\netag: \"691dbd84-a80\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2688,"size_decoded":3009,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7bff080ce05d05842cbcb6fc373b3b0a","sha1":"a2239c4cc79de821a32ba099da91d2c5b1e454c4","sha256":"b7c7d1c41967de68e44a7f13795390b6e4f4deed1c26b467b00f944c47e41f12","sha512":"bc141f9eb06557930908f03a75464ae3c8ca755fb762bf28d4172dd149fda5e262ddfb19f67c6d9191235888cfcc22cb0b17d9102f40ba21b7ca3f6e2a1de866","ssdeep":"","tlshash":"ce51d6def376a259f12525b8a0d00bc3eba43d16875e8936e2d544368f382c63c8d296","first_seen":"2025-12-08T04:02:28.612551Z","last_seen":"2026-07-22T10:52:12.451413Z","times_seen":11,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/rainwinbg.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.286Z","timestamp":1784717502286,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/rainwinbg.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 139742\r\nlast-modified: Wed, 19 Nov 2025 13:13:38 GMT\r\netag: \"691dc282-221de\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":139742,"size_decoded":140067,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"81e60c25115e2d74da01a33324a42407","sha1":"d58a23dace2eb44cf648f9fa6c058687eaa1f714","sha256":"d72cfd84569876d63286ba1b26298463b7ddc8bdede5418493f60f94c9eaebba","sha512":"f77a88d00116ef973610a9cfc48e10dad07400a83b8a823bda8694a5c118f1b3a3aeb70df290476c0b7eb241cf7912efee55be9c6db96127ef26bc6408e646ae","ssdeep":"3072:ngSoqhwMamA6b4d5cwpywlwWlXojL1BM4v1z5zakVuu:nnogfam5opyTWlYj5d5Uksu","tlshash":"ddd3126818219e78c93466773db41bf2b55152141a563aeb9580aff4ef45ffecc80383","first_seen":"2026-07-22T10:08:06.644334Z","last_seen":"2026-07-22T10:52:12.452302Z","times_seen":3,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/dist/js/scripts.min.js?v=1.2.5","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.081Z","timestamp":1784717502081,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/dist/js/scripts.min.js?v=1.2.5 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a60670f-2125\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8485,"size_decoded":3012,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (3531)","md5":"5941c8cb55bde4b2cc24a6ed4ff08f1a","sha1":"6ae966638ac68880e24e46c9d66f4e54b2e902fe","sha256":"6c7214f211a09d913bf9d0ef5a2e420ea78d4275d15bfb6ed07661c12f1f7963","sha512":"489f44ac531a6876ab4220ad32cc9e1b2631767168d4d6b4d123accf36e7ee2bebf861d023494ea3210265ef8b1473893122500c603cceb0cdcd0a78e2bb9562","ssdeep":"192:ajmU5FJoVRReWlAWLAGw9rPBImzgcxh2xYRvGQORa20WGW/dc7yyj/qCho:OFJ+RDAGw9r0hJ7","tlshash":"5602535653b22c7d45736a195e7fae0679b880ab1d83e816380ff4804f784fa43b47e9","first_seen":"2026-05-02T07:09:17.931605Z","last_seen":"2026-07-22T10:52:12.453225Z","times_seen":15,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/10188811-41ab-4cbd-9226-64fbce346b00.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.131Z","timestamp":1784717502131,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/10188811-41ab-4cbd-9226-64fbce346b00.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 1980\r\nlast-modified: Wed, 19 Nov 2025 12:52:24 GMT\r\netag: \"691dbd88-7bc\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1980,"size_decoded":2301,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cba74cea8fe6c59a4d939e2e94615c6b","sha1":"33a5aae92cd699f24df8168e8cc0454a5912c0a7","sha256":"0531737cf8ef31a4669653610977a5529ff633bd38063c7aaf2dd9f4a0033a60","sha512":"ee34165999fb2d0b059472964a7ba8071692cb19153de8c09d81f21d67c25a350c6a20374fbb5adbc8011e1d2628be52af8859e3adc6f982c1a7e22c86332e53","ssdeep":"","tlshash":"9a41e92817a80308fda16bb471d51f56f7e4b53ac6414b4940829f2a2308df87cdc4cf","first_seen":"2025-12-08T04:02:28.616426Z","last_seen":"2026-07-22T10:52:12.454109Z","times_seen":11,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/18.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.135Z","timestamp":1784717502135,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/18.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 1148\r\nlast-modified: Wed, 19 Nov 2025 12:52:17 GMT\r\netag: \"691dbd81-47c\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1148,"size_decoded":1469,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cdc831b6b11226f06fa66ddf16669fa0","sha1":"bc15af299bcf51c7f9799f324cca18f916ee4a70","sha256":"a9acb299047f1409952793a383a1685b151a3fc57a999a9cde69e73198036afc","sha512":"74f9f13a33628f71a2fc92f112f220da14cd129aa183114bdf8d888d22c13579f74ed27f152e2fe4a93044b98b6f207d1dc17551fe2bdec6181585087ec51856","ssdeep":"","tlshash":"5e21652f93156349d90a36f520c42b82eb2d7c399253b6bbd38a03251b04ad6698d0cb","first_seen":"2025-12-08T04:02:28.682592Z","last_seen":"2026-07-22T10:52:12.455179Z","times_seen":11,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-500.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.298Z","timestamp":1784717502298,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-500.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19580\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\netag: \"6a60670f-4c7c\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19580,"size_decoded":19903,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19580, version 1.0","md5":"95c5b525d84aaf5a8411f6ae51916cfe","sha1":"426515e1c6be3e3b101c0c79f29741ea57cdb0ec","sha256":"01ffc8802167df3b7c029549092fd0aa9f0712e089ef4e26c543376de69faa91","sha512":"24907cb28e09ebc62f256916b1a104a53f53b4b284c78380ce450efde9081772bab7b1772dccc7c464e9be21ebd2ee8e023046714a047fd1973b68969bc90685","ssdeep":"384:q2wsotK+EWugFk5Ab1n1sHQySPOqTJ7BsARD5Wzxy7ZlcU+jXzauPc9m:GzlE6r0wtsALhjuWuYm","tlshash":"af92e1217443c4c9ee3d98f24e4fdf3481b8de1d097e21592ed24283ebe57449a3e945","first_seen":"2023-05-01T05:27:13Z","last_seen":"2026-07-22T10:52:12.442241Z","times_seen":180,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-includes/js/dist/hooks.min.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.072Z","timestamp":1784717502072,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-includes/js/dist/hooks.min.js HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Wed, 22 Jul 2026 06:34:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a606486-13ba\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5050,"size_decoded":2183,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (5014)","md5":"55c5129ccd0fa8f383d9de82a91c5877","sha1":"596918015fa62e4f18533b69b0e6822ebee3cb2d","sha256":"cce388fed1a82ebd20ce7d9601e4b6c83a425ea201c333d71b1183ee887cc090","sha512":"956ab39b4bc0577f0ac50a842bc7f71ac1d5b6f7148f9ba9bdb2a84001b96362f077d417144dce171464de8aac71ffd6e639e35ca12da4de2d12fddd660e64a3","ssdeep":"96:lu/16WIHBLusBcADGDd/R5h2RTLlD3jMXY2yGy94E34sTY2Cif:lGIhNBcAD0NRv8XlD3wXY2yH+EoaY2f","tlshash":"5ca151c43542b930e2b77027f0ab58d46175abe1a82d8446d59cd8f12da39cee0e7b3d","first_seen":"2026-07-02T22:01:42.321596Z","last_seen":"2026-07-22T13:29:36.485288Z","times_seen":8050,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-includes/css/dashicons.min.css","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:41.742Z","timestamp":1784717501742,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-includes/css/dashicons.min.css HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:41 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 22 Jul 2026 06:34:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a606486-e67c\"\r\nexpires: Fri, 21 Aug 2026 10:51:41 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59004,"size_decoded":36065,"mime_type":"text/css","magic":"ASCII text, with very long lines (58969)","md5":"6c05185027c3a169cea5b065ac28b6f9","sha1":"d075b19cf8656586e9a561d00ea64f19ff0218ee","sha256":"26a7e7b9d4bb9948771c126085b99fba6546af4399e6263e8a69a3e33f6271cb","sha512":"ecb2602801c8b16c7c079c8f76b09e7b42d71000ba3968fc8c173f8c88cfe99e3739f1cc0149ddea7e69e04755f9b077c48f622e7ab8275ec8b4fdf040ee81f5","ssdeep":"768:oey/Z24B3P3aXOhUzSv16CAyLquqSfurIdUMbs73KO08QSJ2BQH02CRqxMWs5IJq:ox/ZvB/qPWMiquqioMUXQSJYIMW+IJq","tlshash":"2c43c2b1a74a40d677b0c843af65b26a5582bd7df8409cdef40b821c1af3635069dfb8","first_seen":"2025-12-02T22:25:19.065399Z","last_seen":"2026-07-22T13:42:31.638351Z","times_seen":63173,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/rainbetfav-300x300.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.520Z","timestamp":1784717502520,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/rainbetfav-300x300.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv; c2_popup_unique_name=GVgRBVsdH1UdDFAMRVoXBg==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3768\r\nlast-modified: Wed, 19 Nov 2025 12:44:55 GMT\r\netag: \"691dbbc7-eb8\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3768,"size_decoded":4089,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7ecd14b4037aab18af49c0c24bd43d97","sha1":"34174cb594165b8aa92fa4fd28114a00ef779f8e","sha256":"b47701b3befdef1d213d351741c2f7ef6a4c88d3a26854f041b760f46c94be29","sha512":"03b0c1ac961caedba30c69b8b85267e8de2568e13a02599b3ea0dbe1bc456fa137e0997359ff13fd3c154df378331d7fa11f985443b429fa5df0d677ece25ed8","ssdeep":"","tlshash":"38717eb517376779c6701eb4e06036e2ebd07517ca023566a0280eba03407c17d7f5bd","first_seen":"2025-12-08T04:02:28.687932Z","last_seen":"2026-07-22T10:52:12.458725Z","times_seen":13,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-includes/js/dist/i18n.min.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.074Z","timestamp":1784717502074,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-includes/js/dist/i18n.min.js HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Wed, 22 Jul 2026 06:34:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a606486-1664\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5732,"size_decoded":2819,"mime_type":"application/javascript; charset=utf-8","magic":"data","md5":"12ebec1b36678eb1da4412af6c65751a","sha1":"4cb5d87353d9a06fde067063787a4beed692ba77","sha256":"558ae0ec83cc88de0929fde86b87c231246aafa9c961ebffb3257b05f62ca5cf","sha512":"a1bbd93277a59086bf27da7dcc60434b717ac521bce0618aef7c914789497a22cf56441a7f300f1bb7a6de56ca624226883d048f6eadbcc049dc717338189bb6","ssdeep":"96:IE7/RPgrMs4WLJOmlWS33c0xyE2B1596NiH826V0NG7CXMGOyd/sEomkKvYCGaMe:3hgws4WTBYNB1C9aNwAMPyd0R3SGaMSL","tlshash":"fdc1a7c975daf056235910a594afb005e134be2870debc00aae0c4957eb44cdb2b7fba","first_seen":"2026-07-02T22:01:42.315643Z","last_seen":"2026-07-22T13:29:36.485865Z","times_seen":7875,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-700.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.300Z","timestamp":1784717502300,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-700.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19768\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\netag: \"6a60670f-4d38\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19768,"size_decoded":20091,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19768, version 1.0","md5":"8b364bf29bcf08955e8ab90358a8c1cb","sha1":"c8069a4fef1e4643f0454f3b11ae920688a6d121","sha256":"3c3e418bbd1355279dc9a7b5d7a6ff58a73432bd49d6082a0f1544cc1c593e5c","sha512":"7ce04e5001b01d3e4f416f6674d19b76e768fe0f036b1b03fa929af6c430f9d5fb008307e61163b3948ebac0507125cfbd12b49c9419eaa0b82e3693ab7384fd","ssdeep":"384:dA6vMaYevWRWREANJZjjrHqj1aER5RDJZWxHQP73qA03fMtxNjLs:/vMaECpjrwL3XQxHoL0P4xa","tlshash":"c892d09e8d29a0e4da5e5f718ffee6de006fdfb510c5c80c0596f718c805dba941e81a","first_seen":"2023-04-08T13:53:30Z","last_seen":"2026-07-22T10:52:12.460348Z","times_seen":187,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2021/06/leon-casino-11.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.113Z","timestamp":1784717502113,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2021/06/leon-casino-11.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 18550\r\nlast-modified: Thu, 20 Nov 2025 07:06:29 GMT\r\netag: \"691ebdf5-4876\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18550,"size_decoded":18873,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"166d03399e00fea5ee95682848ba6ced","sha1":"8d3a4362d0652539757cc8b6df0468130bbae229","sha256":"b40dd7bfe23198f37953a766fa35a394b0bc618a188a99a46f09b873bdf4bc62","sha512":"d0ea56bb3b02d3cbfed8f84ba8cccf710cbfb36db9463b032c15354a4beda700ed26f05b2d7aa215b38c7af9d6b76d273b9c0ff6f32ac15842743d958a5143cd","ssdeep":"384:LwTMXYtfhiys63x8GW1AtcB4wP05M3PPyf6tCgNqDq74NK2QoT0UH4yFHgos:cTMRy8GCAtmnA6tCgNcq74NKkTrNZgos","tlshash":"5682d0e3dbd15b18fd1abe345f535001aa85bab8a86c5f34828bc0187f8c785f61e643","first_seen":"2025-11-13T03:52:08.1269Z","last_seen":"2026-07-22T10:52:12.461167Z","times_seen":5,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2021/06/lukki-casino-8.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.115Z","timestamp":1784717502115,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2021/06/lukki-casino-8.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4418\r\nlast-modified: Thu, 20 Nov 2025 07:06:29 GMT\r\netag: \"691ebdf5-1142\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4418,"size_decoded":4740,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d01b3e09ac6a68bf4ddd5088eeece361","sha1":"bc6eb050ea932e43f3c03c6dde7a584b9545b7b5","sha256":"d9db133b5472ada60b4553b9b14628cbb581b4aa8d9040806980bf3e74e47cdd","sha512":"d5024135988eb1fe6d7343af4b185a87a3bdccdec270cdb5c02be82dd856bcb9db604ea4e2d70131e6381ed321d99905a9c27909e6c4b5d92d4302d9a6314db2","ssdeep":"96:TElbw+iXtIRGmci3vpvaJmkrL9Bu1ROoSD86pOvBVeKlginBdCrbFzN:OwTCUmci/BaJ1XSFVFLBYPf","tlshash":"05915d1e97a6d382eb216ffce1902356a3157d31c2857d3145e9672b8300ee42f59e2b","first_seen":"2025-11-13T03:52:08.129441Z","last_seen":"2026-07-22T10:52:12.462095Z","times_seen":12,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/fb1e50c6-45db-42ce-93fa-2244a05711cb.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.122Z","timestamp":1784717502122,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/fb1e50c6-45db-42ce-93fa-2244a05711cb.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2314\r\nlast-modified: Wed, 19 Nov 2025 12:52:16 GMT\r\netag: \"691dbd80-90a\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2314,"size_decoded":2635,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f9e70e0a4bc1dfd97eb4e1a28029e4ba","sha1":"0a9b9d28ce85f116dff79468ca118eb9c9d87e47","sha256":"b5aef05c2d335a0d53a69a79c1bf59222ea85435714b5a46a2233c4eb8c536d5","sha512":"b8ed16f84b5fb1abf52103fee6adc1c628ca350071394b3601004dc84b9c7817307641896ffb6047054d67095f04da262ba6e5789b4ff597bb1824a7451ca87e","ssdeep":"","tlshash":"6a412c2743b58b28f58e2db470849b0bd7dd790126836b79f1c4817d07886c2be4a10a","first_seen":"2025-12-08T04:02:28.666378Z","last_seen":"2026-07-22T10:52:12.4629Z","times_seen":11,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/images/rating/badge-2.svg","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.109Z","timestamp":1784717502109,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/rating/badge-2.svg HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a60670f-5fe\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1534,"size_decoded":1076,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4a307288943507758d275c24d44b7b8f","sha1":"d448cc20c31b50f716eda30aa040806c162aad94","sha256":"34dc3a35cfb7de60205d9b47f253ae9869f2b590c7cd8a5781af35d1f9b368a7","sha512":"b9df3f2005c9cec2ccfeb85fd04e037e3bbe801d39c7e82da29da3fbf8e7368d789f690ee0dedc474dbf1b1d557d0f13ae14ace045c14b3afcd92efe8a8f03aa","ssdeep":"","tlshash":"0931927ee10d2d2af13886bc9e12c478057abcfa0cc2100045e1b9a7d0a20c60ceae9b","first_seen":"2025-06-05T18:04:56.833392Z","last_seen":"2026-07-22T10:52:12.463712Z","times_seen":59,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2021/06/twin-casino-1-8.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.116Z","timestamp":1784717502116,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2021/06/twin-casino-1-8.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5326\r\nlast-modified: Thu, 20 Nov 2025 07:06:30 GMT\r\netag: \"691ebdf6-14ce\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5326,"size_decoded":5648,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0b02fa64e12350f2f536c57b6cea25f3","sha1":"c4c88c5fbff5d4a6eee2fcea1102ef2ea35204cb","sha256":"4ce9975b911e4014b94e65dc254592b41e8aa7e93f4616e4b57c41f5479b5a75","sha512":"3466e6be6ffc7eddc46e6689ff19f2d5fdb01264ebe01c71c9477cc8e35aea89b807466f40506bdafd27992ad9b9b7fe1ad1945e1ea04b4403cc6780b9cc8179","ssdeep":"96:BElbw+iXWihNdLftZx4Vd2RPPID3R8SdWyNtw12joNl5Vb1YTksAnJxZAqM3E9L/:swTWih/LDLmDBrdhTiN95YTksAnJjoi/","tlshash":"30b16daa13fcd44ffc7f7538c99d99408d1f5b068345ae064e02d67d6b29096bde8503","first_seen":"2026-07-08T11:54:26.631887Z","last_seen":"2026-07-22T10:52:12.464582Z","times_seen":4,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/61c01ace-3a1a-43f2-b564-f37e55a17ad6.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.123Z","timestamp":1784717502123,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/61c01ace-3a1a-43f2-b564-f37e55a17ad6.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2336\r\nlast-modified: Wed, 19 Nov 2025 12:52:18 GMT\r\netag: \"691dbd82-920\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2336,"size_decoded":2657,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f111f7ef53193e4da6880e13be80733c","sha1":"ec8caef1631e4f0b6f02e83c4913b7c908771425","sha256":"2700c2db71cf9307807a9e85fc2f8d85b0bed6970414f626ac569ab4f3fbefc2","sha512":"ab9ee5d79f8b5e6cb4902376e281a5992f07b2ed60481b489cdde28820dfde3f4367bcb6b8cac2581c9d97b5244d6a1b5ec2b0469b0f82a9331882a9ae283cd8","ssdeep":"","tlshash":"c441e92153550b1af95f1bf022a16f10eaf1bd75d3416e199243438357a02cd795f5cf","first_seen":"2025-12-08T04:02:28.680985Z","last_seen":"2026-07-22T10:52:12.46539Z","times_seen":11,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/dist/styles/styles.min.css","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.035Z","timestamp":1784717502035,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/dist/styles/styles.min.css HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a60670f-90cf\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37071,"size_decoded":5518,"mime_type":"text/css","magic":"ASCII text","md5":"b4ff3bfe226d51aa7d62c65d9dc21b68","sha1":"feb0060ac2a89a7e6cec259fe4fa2abc6554432a","sha256":"81adf3d9093244663cca03c502058b0131408962a15d9a035609f7908249f3fc","sha512":"9183893095c0cc667e25a3015080ecced33778f4cefc8d49b639875cc053b59945f2942b8606ba193e39bd68a30570d4d8ba0fbe852ad3ef95cb37c762b835fb","ssdeep":"192:/NqClYjXbiLZmBOll/qnewojZ815/t4ssaWZZ+ya76kCaZQF7hoCkiufoSfufTGG:TZs5eoQFlN3svBeb7","tlshash":"9ff222216ab738d9651ff018ef99260621585007f14addf8fedde2886fce29484b1b4f","first_seen":"2025-06-17T02:00:31.753232Z","last_seen":"2026-07-22T10:52:12.466248Z","times_seen":21,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2021/06/verde-casino-7.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.118Z","timestamp":1784717502118,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2021/06/verde-casino-7.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8482\r\nlast-modified: Thu, 20 Nov 2025 07:06:30 GMT\r\netag: \"691ebdf6-2122\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8482,"size_decoded":8804,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2d6a1157713c25ce590e5a8a300baee6","sha1":"98673846b415a3fdc76102e8e4c54d433a776f11","sha256":"ac2934ad6ecaea312e4e5b9d065671c303a6992a57437fa9c6bab420c328cbcc","sha512":"42b5a87101eac27104609554a450851a5ffbdeadf9292af29bfec98d4d71e65c511bf1a84ddf8816d083fa707da12de4d7f9a5c80ca3514e6ce70e2312e9d7f1","ssdeep":"192:9wTXUbR4NwXWOo06k7OF0zkg+YXOvW4awmmV2yTWtmakKko:9wTXeRgOP6wOF04gRx4TmzyTGkK/","tlshash":"30029e22a34d927af1591bf644b02b05c72d52124b9f233ea3564f998b2cd5b4dec2cf","first_seen":"2025-11-13T03:52:08.150516Z","last_seen":"2026-07-22T10:52:12.467136Z","times_seen":5,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/images/icon-tw.svg","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.289Z","timestamp":1784717502289,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/icon-tw.svg HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a60670f-4f8\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1272,"size_decoded":1023,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"050a8b972877792f5d38f708b638832b","sha1":"e02fc4068c7b4f4d422983ac1333a5cec53c98cc","sha256":"4abc066cbd2005dc4209be2c2ab5e1eaba41520037e5a54bc8d0416422906305","sha512":"d5920083cd5c67ae65c3d92dde8ba0033db1ccb4b819be08585a3e6ab508468d59530e53d811dbb8fc878426f14ee85fbe507126baa5d1d97ae0e5fa8440210c","ssdeep":"","tlshash":"0f2110e833ec81c45a47c7e1ee362e14796b18fa2f96cb81466456b07e1825c8e5ce74","first_seen":"2025-06-17T02:00:31.759487Z","last_seen":"2026-07-22T10:52:12.468029Z","times_seen":15,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2021/06/Xon-bet-casino-logo-2.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.110Z","timestamp":1784717502110,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2021/06/Xon-bet-casino-logo-2.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6322\r\nlast-modified: Thu, 20 Nov 2025 07:06:28 GMT\r\netag: \"691ebdf4-18b2\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6322,"size_decoded":6644,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"08339b12a2b42d662884357f41335b17","sha1":"32bb74f51ec062ec9155d76d329babf3e689082b","sha256":"791754c54ae39abd45a6ad27e67d10cb423241108aaeacdf94060668bb697a24","sha512":"e89ad3b7f11387f75373f6b3ebcfdf1ecc4f8d5cbb7c6aa6f3f2519685ab1528447b3c8ead46aa0474e9c646e0d2434867eca0c4c1ea6a5b913ee19fea50f5d2","ssdeep":"192:ywTxnRybUXJ9bvf8cUuN/ucz8oaymWP6W3h:ywTfX3vf4joaEPZ","tlshash":"2fd19ebb9781f5aaf218a4b1d5917178d6c25512950a1f8fe1fc024eefb1c832d3da30","first_seen":"2026-07-22T10:08:06.634109Z","last_seen":"2026-07-22T10:52:12.468892Z","times_seen":3,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-600.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.301Z","timestamp":1784717502301,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-600.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19464\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\netag: \"6a60670f-4c08\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19464,"size_decoded":19787,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19464, version 1.0","md5":"765a7790e9005f066ddfbc939bdd4621","sha1":"c730bde751b462838db69f24c2c94019f964e029","sha256":"3c316558e18d2996ed4394bc36b17d993c21584f30d16dd0e6d87673f5892c18","sha512":"06147c122afcb704457b3a2775d7e375bb7672a47faf8b4743d12b88a784b20af6580882286e2adb0dad9dfd22648e4994e72f54013172680c2c596fc142ed48","ssdeep":"384:7MtxnDHqurSlYJePkNY2PEJrIJpbXHjn8Q3XSPb0W2pphsPwnyuDmsJlbrUM:7c0ukPkjsx2bXz8LTv2bAu6Sl/UM","tlshash":"6392d0bbb4af74f06d03bd33364b1ba1d9da25412cb8981842f7f481a9fbd88e655009","first_seen":"2023-05-04T15:17:50Z","last_seen":"2026-07-22T10:52:12.469753Z","times_seen":176,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/rainbetfav-36x36.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.521Z","timestamp":1784717502521,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/rainbetfav-36x36.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv; c2_popup_unique_name=GVgRBVsdH1UdDFAMRVoXBg==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 898\r\nlast-modified: Wed, 19 Nov 2025 12:44:55 GMT\r\netag: \"691dbbc7-382\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":898,"size_decoded":1218,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"de31e0848aea8621fce848599a2f837f","sha1":"3c38f36c3e1e50bf29f15db7399f88debc350701","sha256":"b9aff756ba31a26aa6100d3c928baad608d06924a23ba037f80423bd0667b297","sha512":"04fdb663704c06bd569a9ebbc895e27947192fd3c5d7587f0d45965f32fa0610b89b57bc0c07721a7e6051f721c970ee5280ae530aa578d7182d2b98b1d22277","ssdeep":"","tlshash":"6811203fa3785b5ee0087d7461e91fa2e326ee07c227872a814487a20b244c2f96c187","first_seen":"2025-12-08T04:02:28.610897Z","last_seen":"2026-07-22T10:52:12.470565Z","times_seen":13,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-600.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.631Z","timestamp":1784717502631,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-600.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv; c2_popup_unique_name=GVgRBVsdH1UdDFAMRVoXBg==\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19464\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\netag: \"6a60670f-4c08\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19464,"size_decoded":19787,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19464, version 1.0","md5":"765a7790e9005f066ddfbc939bdd4621","sha1":"c730bde751b462838db69f24c2c94019f964e029","sha256":"3c316558e18d2996ed4394bc36b17d993c21584f30d16dd0e6d87673f5892c18","sha512":"06147c122afcb704457b3a2775d7e375bb7672a47faf8b4743d12b88a784b20af6580882286e2adb0dad9dfd22648e4994e72f54013172680c2c596fc142ed48","ssdeep":"384:7MtxnDHqurSlYJePkNY2PEJrIJpbXHjn8Q3XSPb0W2pphsPwnyuDmsJlbrUM:7c0ukPkjsx2bXz8LTv2bAu6Sl/UM","tlshash":"6392d0bbb4af74f06d03bd33364b1ba1d9da25412cb8981842f7f481a9fbd88e655009","first_seen":"2023-05-04T15:17:50Z","last_seen":"2026-07-22T10:52:12.469753Z","times_seen":176,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/complianz-gdpr/assets/css/cookieblocker.min.css","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.031Z","timestamp":1784717502031,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/complianz-gdpr/assets/css/cookieblocker.min.css HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 20 Nov 2025 10:34:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691eeec2-ade\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2782,"size_decoded":1047,"mime_type":"text/css","magic":"ASCII text, with very long lines (2782), with no line terminators","md5":"182c31e4b049004a343781556afe8606","sha1":"d37c351aeeadbb654d441621b611bed8d7104aa1","sha256":"afe6634c4de97ea6dd0824fa7ad34f551b6faede0ca95db78516165ab1610f47","sha512":"cbfdfc6c97bb4fc1be24576e61c6accedb203bb5b38054393256ae354851d6beb91bd3afac2d7e5bea7729b3aeb28579dedb848b344f7ee592228fabe7ffa7fc","ssdeep":"","tlshash":"305129756d931890b3feef052d80b9842a29f753c02e0dede162962cb1df586cde6345","first_seen":"2025-03-07T16:44:09.983719Z","last_seen":"2026-07-22T14:01:35.383859Z","times_seen":30786,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/dist/js/header-search-logic.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.083Z","timestamp":1784717502083,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/dist/js/header-search-logic.js HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 984\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\netag: \"6a60670f-3d8\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":984,"size_decoded":1331,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"95a9aec3eec3385f61adaccf426e2fd3","sha1":"67e44e58f75a4514ba008c2ee3d5dcfd307c2a75","sha256":"52cd79f5c766b41f3be8b2c592ffa11eb63d657ea8c77b8d2be5875a2f98abe8","sha512":"a78a430b4249582e89a6da526bf80eec5e11991c0c780e248e53c3acb9b315b60bdd03082eeb146fd9d218cf61952ab5408afa40adba8081e03d1dfee3cca148","ssdeep":"","tlshash":"7511b4396128b439923b01c7d266afd53d59008ff840427966ac47ee2fc1ce3a3625fa","first_seen":"2025-06-17T02:00:31.74037Z","last_seen":"2026-07-22T10:52:12.472275Z","times_seen":41,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/lars-round.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.119Z","timestamp":1784717502119,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/lars-round.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 118940\r\nlast-modified: Wed, 19 Nov 2025 13:59:19 GMT\r\netag: \"691dcd37-1d09c\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":118940,"size_decoded":119265,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"79bfe13483fbf7c54201a4355bab3721","sha1":"31e8ce19eb3963eac0b504090517439166b725eb","sha256":"db6dff5ef9ec0b81c6931542259f617b98590354b0e8e75ba8db6e17d260c779","sha512":"ec71b9e8512a0b98822762df1d44dbb77a44c51b691a2716ed2d53bffa31436cf8bd372b337def725989f4923f5a5f65a94a4c54937cc88f2df4fb9391c21e1a","ssdeep":"3072:CMiYnGS3Ss1NwHXKVe6f71bzui1eacrqDG:1/LCs1a3Pqdp1eE6","tlshash":"2ac312dca601a16d51fe9561388f656db3ed62b62838138b033d53b3d7b8034586fabc","first_seen":"2026-07-22T10:08:06.652665Z","last_seen":"2026-07-22T10:52:12.473233Z","times_seen":3,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/images/icon-arrow-b.svg","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.288Z","timestamp":1784717502288,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/icon-arrow-b.svg HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 223\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\netag: \"6a60670f-df\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":223,"size_decoded":545,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0a9bbb1c127978be9567884421ca6c6e","sha1":"0cbb80cc31a816566457ce4f7338bad10b1ecbf7","sha256":"ca3ab0f046ee46c65242e6c7ccaac1eb8c4055681e62fdc567547f2c5edf287f","sha512":"c27eaa9710a44a986643c39523c20a2ab664607a26efc600e5deb9e577641fca2042391936bea881f326da3f2ce9607983b3c6bd61e451d3731b4bcbe78e6e61","ssdeep":"","tlshash":"e8d02357530c4d1cb511c620d76d3239847d6143434c519cc5222138571915e7d7fdec","first_seen":"2025-06-17T02:00:31.733848Z","last_seen":"2026-07-22T10:52:12.47412Z","times_seen":50,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-regular.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.623Z","timestamp":1784717502623,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-regular.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv; c2_popup_unique_name=GVgRBVsdH1UdDFAMRVoXBg==\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19396\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\netag: \"6a60670f-4bc4\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19396,"size_decoded":19719,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19396, version 1.0","md5":"28ab3b0e8151123d4dc1d08197b61f8a","sha1":"7cb91342ce5dbc20a2378b5d5a85dea3f69467ea","sha256":"fbfb7cf0faeba70db28a9ed1a35b932b2a85bac25d27b1859befec067937393f","sha512":"12788bb3cea49ee0b3195d2e0588d7dfdb727a87592cc7772ccca81f4c58d9304f49d45347e9caad96334d451e17e4d4aeae98e1005d463aaf4870e34bc013e1","ssdeep":"384:xb6z6mPqSU/zTjdeJUlq/BJslogLFQ8oga3tkYb4GFD34QXCZigPBc8MU1L:xb6z9SrVil/glooFQ83aCYjSZiQmBGL","tlshash":"9c92d1d5936a5801fb730bf0119a94dbcb83136a0bf4b4e8818cd09bcb5f097417aaf6","first_seen":"2023-05-01T19:05:47Z","last_seen":"2026-07-22T10:52:12.441304Z","times_seen":151,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/simpletoc/assets/accordion.css","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.037Z","timestamp":1784717502037,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/simpletoc/assets/accordion.css HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 03 Apr 2024 22:09:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"660dd398-403\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1027,"size_decoded":787,"mime_type":"text/css","magic":"ASCII text","md5":"7e46c6d521d06fec54ccbe595100711e","sha1":"f07cba2f0f32a53e7b8b1f2064a45c16c73e7269","sha256":"a33079577d26f8a8906e24b3c3cf041b3f792f560802715514cf24e6bd4fede6","sha512":"be8bdb655cace77565a89bccab6c4b3c67694b691e7200894797f3246e2434dbe4091917d680c64e289c1fd28c9fc97fcad4eb9eaeca719149578e246a39ade0","ssdeep":"","tlshash":"3311cb1d23443583632eb19a9683e7759a0f4586ab8c0d9a31c4357c7288adc2b77aec","first_seen":"2025-06-17T02:00:31.820186Z","last_seen":"2026-07-22T10:52:12.475709Z","times_seen":45,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/images/rating/badge-3.svg","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.112Z","timestamp":1784717502112,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/rating/badge-3.svg HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a60670f-5fe\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1534,"size_decoded":1077,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7eeee2de42abcacbff2a6c7bf5a657cc","sha1":"51a3fb1504d7b7e0e33aa5726eeb44afc3bb71d5","sha256":"27c33f3c5feaa8d2e46c4825da890fdc4c413b92c15832715497f617668f9ac6","sha512":"1be718acc70ef82173c17393f61186cb71ef7ad5cbcc77e479846d73c067063e7b9eff8239cfe111b3828655f3f966170677a6e998bc1a8f5d2335a1087ff559","ssdeep":"","tlshash":"5631877ea20d2d7af12885bc9e12d479147abcf74cc3000145e1f9a7d4a60c61cfae9b","first_seen":"2025-06-05T18:04:56.837162Z","last_seen":"2026-07-22T10:52:12.476612Z","times_seen":53,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/complianz/css/banner-1-optin.css?v=3229","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.426Z","timestamp":1784717502426,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/complianz/css/banner-1-optin.css?v=3229 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 14 Jul 2026 08:24:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a55f240-3d9f\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15775,"size_decoded":3247,"mime_type":"text/css","magic":"ASCII text, with very long lines (15775), with no line terminators","md5":"8459c5e5511a771d2c2cbf9348bb7973","sha1":"8dc74efddc3780b8dd10bb82fed470fef8e6c610","sha256":"fd66f68d1b1e1d38e81f3a978e8d767727cb7ea51b80b157192d8255e2c764f6","sha512":"2bd85caee2f1156edfcd0ee2c435dd26935e80795465e88343a2abace2809afde4d25b5187824da75eca8a97fa3f26b68a5a18c5f20fdae7b107396d778710af","ssdeep":"96:su9ppeDJjeWeyne6nxZ1csUi5p8Z1cAvqlIWurrkTobudlYLhf8Iqb56qlym6OoE:f0EpVAWDi5cWi2IWRzZbZ3sMBd","tlshash":"626231a99e0c1164e6dfdf1c3baa860e9114f731b29d1af824a17850f2fe5d11d2e387","first_seen":"2026-01-27T02:45:53.071064Z","last_seen":"2026-07-22T10:52:12.477471Z","times_seen":7,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":85,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.087Z","timestamp":1784717502087,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Thu, 20 Nov 2025 10:34:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691eeec2-9ec7\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40647,"size_decoded":10934,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (40647), with no line terminators","md5":"087de03e5dc079a0742ac8478a5f8c87","sha1":"b14ad9cfa3fa6ae9381806189e7f35f543d185ed","sha256":"fe345dc92f2c901c2eccac134294ff2216e70177dd054ba6f104af6015959ee9","sha512":"5742b4c16babac5856080614523b47dff4f3dff7cc102a3a5474ab1e0c82de4a1e987327beb303775042727b35d3f2498f6916c6283117415725dce206c437ef","ssdeep":"768:k4cjy6JZaYSJjv+YfzwLpstNyuGFGgxesKNVhIkYJO2ybEXoHHFC1aRHQpmiVKbX:IZal8OHQpmZNemLECFKAJ","tlshash":"3903e8b93a9c90b416ee87ed37abab48e4303961dc0fc8609565dc542258dc70f9bfb1","first_seen":"2025-10-07T21:11:17.93794Z","last_seen":"2026-07-22T10:52:12.479453Z","times_seen":8169,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g10102301085.co/gr?id=-Nx8NDCxoi5XHExf6J3e\u0026refurl=\u0026winurl=https%3A%2F%2Frainbetlegit.com%2F","fqdn":"g10102301085.co","domain":"g10102301085.co","tld":"co"},"ip":{"addr":"34.120.31.228","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.091Z","timestamp":1784717502091,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g9508048080.co","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Tue, 07 Jul 2026 23:47:34 GMT","end":"Tue, 06 Oct 2026 00:41:06 GMT"},"fingerprint":{"sha1":"33:85:DA:27:B6:E8:23:41:7B:FC:54:07:F6:E6:0C:F7:14:8B:79:09","sha256":"20:2E:77:9F:D3:C2:12:6D:43:BA:E7:23:70:C5:CD:D1:2C:F0:B8:C4:D9:42:EA:A4:B6:AB:24:B0:98:11:19:A1"}}},"request":{"raw":"GET /gr?id=-Nx8NDCxoi5XHExf6J3e\u0026refurl=\u0026winurl=https%3A%2F%2Frainbetlegit.com%2F HTTP/1.1\r\nHost: g10102301085.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-powered-by: Express\r\ncontent-type: application/javascript; charset=utf-8\r\ncache-control: private, no-cache, no-store, must-revalidate\r\netag: W/\"160-9XoKTHJPhkwR+uq3SOUaam5YNgk\"\r\nvary: Accept-Encoding\r\nx-cloud-trace-context: 7dc778bfce71a8b5a22f713cd3f8013f\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\nserver: Google Frontend\r\ncontent-length: 352\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":352,"size_decoded":779,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (352), with no line terminators","md5":"76c7778e369c280777c7d8889a9a8e85","sha1":"f57a0a4c724f864c11faeab748e51a6a6e583609","sha256":"c5048d5003cbdfc61ecbba655e914de5c09f349d0d85306ef23f5e34e7e3acb3","sha512":"1fcdf37f78b33db612bc9f4159c8148e77bbf0e97b2b6b9f069fe738730e186bf3fed0d5b51bd9c90880d6bda7195416a2ed9dc02487ad202c3dd29ec508bf8d","ssdeep":"","tlshash":"70e026e8b6ea613050f766ac2212c42138736032334c18ebe860236a7ef011e811a7ff","first_seen":"2025-08-13T16:04:47.939696Z","last_seen":"2026-07-22T10:52:12.480436Z","times_seen":22,"resource_available":true,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":3,"connect":13,"send":0,"wait":54,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/092657d8-8e83-484a-9717-442ae1ab7886.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.129Z","timestamp":1784717502129,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/092657d8-8e83-484a-9717-442ae1ab7886.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2650\r\nlast-modified: Wed, 19 Nov 2025 12:52:23 GMT\r\netag: \"691dbd87-a5a\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2650,"size_decoded":2971,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b0cd28c3b7fd01c4bd0a91491643354a","sha1":"68f553857f319be3598b919912eacc9723a1b995","sha256":"cf5f2c4057c53433704fc056bf560ae224b401741bfd2c41f020c7bd68d7aed9","sha512":"c5fe40193e39969119a7b8ea330601a20c993ecc818e8103d081109e1a30aa35fcacff691f591ba06db37271e9b5604853c181a0d5add84f7fee638b66e6b563","ssdeep":"","tlshash":"44512cff1f64860ef10426bd68aa8deef5c9ab1289587f54b2d3012d4b13dc06c6538b","first_seen":"2025-12-08T04:02:28.678906Z","last_seen":"2026-07-22T10:52:12.481382Z","times_seen":11,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-700.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.629Z","timestamp":1784717502629,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-700.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv; c2_popup_unique_name=GVgRBVsdH1UdDFAMRVoXBg==\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19768\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\netag: \"6a60670f-4d38\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19768,"size_decoded":20091,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19768, version 1.0","md5":"8b364bf29bcf08955e8ab90358a8c1cb","sha1":"c8069a4fef1e4643f0454f3b11ae920688a6d121","sha256":"3c3e418bbd1355279dc9a7b5d7a6ff58a73432bd49d6082a0f1544cc1c593e5c","sha512":"7ce04e5001b01d3e4f416f6674d19b76e768fe0f036b1b03fa929af6c430f9d5fb008307e61163b3948ebac0507125cfbd12b49c9419eaa0b82e3693ab7384fd","ssdeep":"384:dA6vMaYevWRWREANJZjjrHqj1aER5RDJZWxHQP73qA03fMtxNjLs:/vMaECpjrwL3XQxHoL0P4xa","tlshash":"c892d09e8d29a0e4da5e5f718ffee6de006fdfb510c5c80c0596f718c805dba941e81a","first_seen":"2023-04-08T13:53:30Z","last_seen":"2026-07-22T10:52:12.460348Z","times_seen":187,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/rainlogo.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.063Z","timestamp":1784717502063,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/rainlogo.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3778\r\nlast-modified: Wed, 19 Nov 2025 12:54:44 GMT\r\netag: \"691dbe14-ec2\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3778,"size_decoded":4099,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b3f1559f7cb6abcbe9a23fc75173c304","sha1":"87b231b2ddbaf4a2cfb71d9bcf0662899d592c65","sha256":"97b00246ef0fe09b6eb39f12cc43179c32c25b0fdb2ceb5bd2a4b7617533709d","sha512":"2ba56e0cf730294aba137e6ccc5b1841e5f7ee1c657acd1416e3a25f4c8cd20f5ca410fbe917b4ea4855b9c111677ec1afa6402a7fe509d308b15f8ad8b0c9b9","ssdeep":"","tlshash":"da713b66b324973df022b5f5016917daea84ac00818bfbf522c441602b38bcc61f8a1e","first_seen":"2025-12-30T02:21:12.811036Z","last_seen":"2026-07-22T10:52:12.482277Z","times_seen":12,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/polylang/fi.png","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.100Z","timestamp":1784717502100,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/polylang/fi.png HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/png\r\ncontent-length: 206\r\nlast-modified: Wed, 22 Jul 2026 06:45:35 GMT\r\netag: \"6a60670f-ce\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":206,"size_decoded":524,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit colormap, non-interlaced","md5":"89ae87dbe8eba0b4cd4c6b9eba8b6c58","sha1":"528121e83ef10b6d3dbb4e9f074b6e186e2f85e6","sha256":"e8df63258164e8dfc0b438226789c6f910c0748974e47a10e01692db4dce9aa9","sha512":"c4086ba68ec4c3cdf21ace3951bcf439a7e113c584b3c02c8fe93b0551daaa22c9a566b2ac3448272d38c785f02e1db57425b20d64221c57e80037a906842f91","ssdeep":"","tlshash":"fed02296438bad34ed650973e9a7db8dc0b39f8048234707a5abb4a58740643c8f0cd6","first_seen":"2023-08-10T21:26:20Z","last_seen":"2026-07-22T10:52:12.483034Z","times_seen":81,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2021/06/Logo-black-2-scaled-1.png","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-07-22T10:51:42.103Z","timestamp":1784717502103,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2021/06/Logo-black-2-scaled-1.png HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:51:42 GMT\r\ncontent-type: image/png\r\ncontent-length: 909914\r\nlast-modified: Tue, 24 Mar 2026 07:09:17 GMT\r\netag: \"69c2389d-de25a\"\r\nexpires: Fri, 21 Aug 2026 10:51:42 GMT\r\ncache-control: max-age=2592000\r\nx-server: srv01.cofeco\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":909914,"size_decoded":910238,"mime_type":"image/png","magic":"PNG image data, 1920 x 899, 8-bit/color RGBA, non-interlaced","md5":"b3bcb5b0d94334e40d30d4a44989683a","sha1":"554b65a0805b826a382bbfec6096aea148f8c5ff","sha256":"396d74d76903c267505c595019830cc6d5767ae5467fc3694bcb60de47182522","sha512":"99901c1895cf24de52b7764488e60d78b35763b0ab2967270a154d972091b27c941d384900d5980856990d1fdd6ba1c8f0fdaca80dbd55d9f491299ef4024159","ssdeep":"24576:dphbV0zQBHeUrynrWlcyRjEOTMllKJviAo:dncQB+UOalZoOTM7KJv5o","tlshash":"e21523148abcef4ff8a6c58616a13889f7d026d0ebd6e2d6bc05f4a4b1576033f405ad","first_seen":"2026-07-22T10:08:06.631599Z","last_seen":"2026-07-22T10:52:12.483771Z","times_seen":3,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":68,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}