{"report_id":"1904c02c-2fa0-43fc-9bd9-6eb5959b5f12","version":6,"status":"done","tags":[],"date":"2026-01-07T07:57:09Z","url":{"schema":"https","addr":"rainbows.run","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"rainbows.run/","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"title":"Rainbow Pre-Sale | Early $RAINBOW Token Deposit","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"rainbows.run","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-11T07:57:09Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"rainbows.run","ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-01-07T07:57:10.962267Z","last_seen":"2026-01-07T07:57:10.962267Z","alert_count":50,"request_count":25,"received_data":10626087,"sent_data":13732,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP:8.3.17","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]},{"name":"Ruby on Rails","description":"Ruby on Rails is a server-side web application framework written in Ruby under the MIT License.","website":"https://rubyonrails.org","common_platform_enumeration":"cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*","icon":"Ruby on Rails.svg","categories":["Web frameworks"]},{"name":"Ruby","description":"Ruby is an open-source object-oriented programming language.","website":"https://ruby-lang.org","common_platform_enumeration":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","icon":"Ruby.png","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rainbows.run/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"89031e0fca1fcf23bf3ae89487230bf5","sha1":"a2b26e0b3d866222f55b567862b05217410da31f","sha256":"dfa937999e14d98b514b436597c40521e09e1652f9b9deab05797e65e3d62ad1","sha512":"6af907a87f0b376e9401a00eb470d84f6fd3351acc8ef0dda7856052f68197b87b21a9984a12b8058572a5c4e66b6a0559c48445c92fd59b464879f93d1d617b","ssdeep":"192:BKcSzE8uwDrKyvu/YSxo7GpITlTpMfBJZZSDVkTjB:BKcP7wSym/9xoSpITtWJZZKkR","tlshash":"2b22c7e7f809655d0339c178142f6cc51138be819448a729d7689ceeb83a684e4affcf","size":10623,"data":"","first_seen":"2026-01-07T07:57:14.574409Z","last_seen":"2026-01-07T07:57:16.707396Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"abc9c4fe6cb80a6a17f188df4eab170e","sha1":"ad31e75c2cf706a8ae4a74dee21a5fe12ba6e3b7","sha256":"fbd4c2a7ee0033ed4d1f0bacf32090880c9ecb1e8352707109171b57314451ed","sha512":"b698f3d9dfb571eea1705f0d3aa95115ded55f5fd0c8b6d7fcbf395dc7cb1ceefe0fa5310786a17e486807e532f5b91fd04cbaf0b920fb8cf8371d8ab5a3a49f","ssdeep":"1536:t/CUkN7krqTuaPHjo0TJwpuoY3MXEG64ZxLD79cmHOYz3YKtMzcJiS/0zJOVCuY1:trdaPDo0TJtZqf3RtMzcJilz0KHI1ix","tlshash":"89b383c5990b94e58e1121eed477ed05e0680a23cdacf2a3b92cded2745ef66c48713e","size":115118,"data":"","first_seen":"2026-01-07T07:57:16.707925Z","last_seen":"2026-01-07T07:57:18.757702Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/request-5.47.1.min.js","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"404ec3d511ebb2fd7a39ec0832d9c4dd","sha1":"95567ae7d91998353180b608c35e8fda253267ac","sha256":"d320f21ca2aaee3a37a53ffc37ea1c1cd7052489e81f5f36eb5acc5ddce0189b","sha512":"6bb2fbf72e9bb9616f8071642753aca9dbde2131ed4c82347a184ed3e995affa62dcb7998d5afbfc5379b962b826a3f38b00e17e8dcf3e57472060a6bd3127a7","ssdeep":"1536:O/EQy1h4rSbbjCdSfXiQ1rPAPBEoYTQXEU04Zxekn7ZemzCY3BYKtMzcJia/0zfq:+rcb2qiQFPjhUJNjtMzcJi9zeKTI9Qe","tlshash":"a3c350c6994b94d58e2521dec07bec08e0680963cdacf193ba2cded6745ef66c44723b","size":119343,"data":"","first_seen":"2026-01-07T07:57:16.704372Z","last_seen":"2026-01-07T07:57:18.745362Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"d1700ae249b9ccec95b7021149ebe3ec","sha1":"1097a764dda704d6bd35cdd4175a10f0b0989c38","sha256":"6540f028d3758af2c012a432eb82f78de7e1fda9afca3b0cd951a6c8085f5db4","sha512":"c6f530004e7cc25a049004ca641d8b92e77ceb1c40d1487d251db4bab71804d0a27e8ff63a282d12e7a414b224438c2569e353cba1eaf98357b2e83f90332c73","ssdeep":"","tlshash":"9ed0a795386a8930599901461476e798266020a06711924081d8cc1f6e21f930ca159d","size":217,"data":"","first_seen":"2026-01-07T07:57:16.709401Z","last_seen":"2026-01-07T07:57:16.709401Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-25T01:51:29.972722Z","times_seen":405441,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ff05029e2996e4f6abc2e32db400ec58","sha1":"3bae8b1e2cae678f2b427d8f55e012e68da69639","sha256":"4d83f6be14203833a941e98c9d7ebcddbd0319b02162d26082429e38a18719d9","sha512":"77b12b7ed6d43edb02279ea6c7dcab4bb8107c80a2edb7dfd2073d42703098eeae76f9f47f1b5dc49398afc060c418cd7236e4e54f25808a86bdba2e437c5b9a","ssdeep":"","tlshash":"4f11c0753a1a5634c9c5418b317eeba93e3260717b029184c36cdc295d28e8718efdbe","size":902,"data":"","first_seen":"2026-01-07T07:57:16.710431Z","last_seen":"2026-01-07T07:57:16.710431Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rainbows.run/coinlist-0a2620ad3872299f031d5d02d8473296dd4870dda9252fd93ef46f44c7b85ccd.css","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:46.869Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /coinlist-0a2620ad3872299f031d5d02d8473296dd4870dda9252fd93ef46f44c7b85ccd.css HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:46 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"693b5ef3-34e8ab\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QJba%2FvlRQdDkYSmv9XhtNwQVRXdODGuo1AiS%2BnOEjGgpkgU2W8a0RUoiN4A4B3rEK9HSx1uLm7h1jCiG2JMKtq%2BhqQ%2BFuEK8xiA%3D\"}]}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9ba1e688af75b512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3467435,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65370), with no line terminators","md5":"6254c8b9ca17e27ef6613c01eb9de093","sha1":"91a32de4e0e6fd15b4b737c16901aa3728f5549a","sha256":"df37592ec1043094b7e08884c188302ad9c3e6c227ae7965226d8ef1d6e1fc45","sha512":"0ff7f4c1119d68bbf808d855f175a906e5581fed70e2a90ec2f468931e89f2b4ec6be5d09ef6f22878505aef564a5a876d9e8b12f1d85843a8a5884583b2edd7","ssdeep":"12288:QLckT4S1D3Z+1I+j539snuiGwGZEOPgcA+f:6T4S1D3Z+1lwGmOPgcA+f","tlshash":"d525a4e16c4530bb86738e37b8a19d443b7f9200d0015daaf1bed8f805d55a963ef6a3","first_seen":"2026-01-07T07:57:16.688726Z","last_seen":"2026-01-07T07:57:18.756539Z","times_seen":2,"resource_available":false,"data":null}},"time_used":291,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":254,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:47.998Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 Found\r\ndate: Wed, 07 Jan 2026 07:56:48 GMT\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=XzAdaqWgaEKFyE%2Bqhbp2DIVNsLObWSuiKas52wIkfnqBfKvLut17%2FfeorGl%2BfwMYdXQ%2FxCdd0wISKpuXcoZ7JfOiyj3CrE7MgGXlDPkjE%2BI8N0CltHYftZS9B3DBEnA%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\ncf-ray: 9ba1e68fff9db512-OSL\r\nlocation: /cdn-cgi/challenge-platform/h/b/scripts/jsd/88d68f5d5ea3/main.js?\r\ncache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public\r\naccess-control-allow-origin: *\r\ncontent-length: 0\r\nserver: cloudflare\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\npriority: u=3,i=?0\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri, cfL4;desc=\"?proto=QUIC\u0026rtt=10423\u0026min_rtt=623\u0026rtt_var=16991\u0026sent=5864\u0026recv=151\u0026lost=28\u0026retrans=33\u0026sent_bytes=6887582\u0026recv_bytes=12907\u0026delivery_rate=54382307\u0026ipace=0\u0026icwnd=12000\u0026ss_exit_cwnd=86906\u0026ss_exit_bw=41086702\u0026ss_exit_reason=2\u0026cwnd=202270\u0026unsent_bytes=0\u0026cid=e1c4c3c3d1e2e40a\u0026ts=1629\u0026inflight_dur=676\u0026x=55\"\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10623,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/ES-Build-Medium-a87857a12476ee7ea5ebd255174531a23431ce6fff3219fdf1d97c8c6eea4418.woff","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:47.961Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /ES-Build-Medium-a87857a12476ee7ea5ebd255174531a23431ce6fff3219fdf1d97c8c6eea4418.woff HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/coinlist-0a2620ad3872299f031d5d02d8473296dd4870dda9252fd93ef46f44c7b85ccd.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:48 GMT\r\ncontent-type: font/woff\r\ncontent-length: 44936\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=4,i=?0\r\netag: \"693b5ef3-af88\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fHELh%2BoDIH5NM39kCt5%2FvujsBPG7X7pvOnxaTN6w%2Fc3I1Ru6qYHuttSZtSuWzSw%2BBccdxgYlyukcvY0O2TYLZmVgnc1q%2FcQp4vo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9ba1e68faf9ab512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44936,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 44936, version 1.0","md5":"657048816b7a1963c9420fb56eb5c849","sha1":"d7d782e80977951c13b0c19f56943aacc13469b0","sha256":"a87857a12476ee7ea5ebd255174531a23431ce6fff3219fdf1d97c8c6eea4418","sha512":"d9426ae0a97433c490a311a18808e8642d4f6cf4359afa594e154b802ee83bcc86760ac336c2f4fb3711ef9abbd9df22913848e7161125182c205ddfb3840ff1","ssdeep":"768:9gCMlKU0WE/47KgquIHm6lH9yvUaPpnTuOpgGNisG4cafmoFYFy5w7V4/:qZE/47KgeHHM8aPpnTuOfN7G4cImoF2O","tlshash":"3613f1b786c9d102801293bec38757a3415241c2fd3f1ea37ae9e6cd09406936dfe5b9","first_seen":"2025-06-26T16:09:40.979591Z","last_seen":"2026-01-07T07:57:18.749003Z","times_seen":10,"resource_available":false,"data":null}},"time_used":106,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/019aea7a-68fc-7b13-9ba7-706e6b8cdf32-1765214245-2fa4d57a337175bf7ee0390085963c40397e8b62.css","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:46.874Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /019aea7a-68fc-7b13-9ba7-706e6b8cdf32-1765214245-2fa4d57a337175bf7ee0390085963c40397e8b62.css HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:46 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"693b5ef3-1454\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s2Kp9R0G1Y74280nikrevUECNShTx%2BhI8nR9EhqqWP99aGbIC8aCuUECmGsHJsnC6Pv%2FY%2BD%2FcFPrUgxZrkqLM1A3ykMqTLKnZJY%3D\"}]}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9ba1e688af78b512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5204,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (548)","md5":"edaf0c734fb50982b8bb932f1a9cdcbd","sha1":"2650f52930638e893950eee41bf642edefb6289f","sha256":"dc9f2535f892265ca4c6bc3429386b9abd3f19057d1fc9577c6cfa8580627f33","sha512":"831fd899a115064fd0d48956a6771e36412b765fdc71b5e23d63674d646eadcf9e3b14c183733697161eb76cbc76490308136fc9a3505ebfc340b0ad965fb914","ssdeep":"96:IrpczpXSQXSXXSsXSEXSlXSMXSlXS7XS7XS0XSEXS5XSssXSxoXSsXScXSF5XS0E:PiQiXisiEiliMili7i7i0iEi5iBiais1","tlshash":"96b19e407e64f90c26033affb557940babb8e86d953939dcfab814584b36240d36729f","first_seen":"2026-01-07T07:57:16.690752Z","last_seen":"2026-01-07T07:57:18.757115Z","times_seen":2,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/019aff08-615a-7490-bc16-900aaad1b61b-1765215330-cf3124757d447575aa19a21417201122fbf947b6.png","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:46.878Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /019aff08-615a-7490-bc16-900aaad1b61b-1765215330-cf3124757d447575aa19a21417201122fbf947b6.png HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:46 GMT\r\ncontent-type: image/png\r\ncontent-length: 805303\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=4,i=?0\r\netag: \"693b5ef3-c49b7\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fpWh0nzZUS6nQYivTCbUHVFBJ7pDxPNGJU1RAH2RXzeK%2F4%2FTzjcqc3pj6IWf%2FWabC9delRY2u9DfgtS6XHtnLPF0umm3hL75Ils%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9ba1e688bf7bb512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":805303,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1600 x 1127, 8-bit/color RGBA, non-interlaced","md5":"4b0ceb8d0db81201e7d089e9b96c2b82","sha1":"0f74656e48a9bb89f7561636aa53e72e6b2edd00","sha256":"ed049b689c2c8ddf2ec906f07b021c04a190cde1c3ffd6120c9af69723b6438e","sha512":"3be0fe15278149bba49c0471ecd487f6f592d275a228c3ec62dbb98cf4b4e9c1e5b7a78cc96a67bff34202e45ab2396edddfd6afb314c1aad256cf76720e8f79","ssdeep":"24576:cTaN/9GpKYOf7Sw5FYHCnAkvvRUqdQ0d1:saNVxYQ7Sw5U2zvX","tlshash":"c4052319e2ebd842febc143710d409051afc30424e759f35406852db8be7e7e77a4aea","first_seen":"2025-12-10T12:23:34.699974Z","last_seen":"2026-01-07T07:57:18.753369Z","times_seen":4,"resource_available":false,"data":null}},"time_used":324,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":264,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/ABCDiatype-Regular-9d0d6244f46671b719d4f5d739a3b341e1bfb835e5e9d94aeb26d8a92209ff3c.woff","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:47.959Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /ABCDiatype-Regular-9d0d6244f46671b719d4f5d739a3b341e1bfb835e5e9d94aeb26d8a92209ff3c.woff HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/coinlist-0a2620ad3872299f031d5d02d8473296dd4870dda9252fd93ef46f44c7b85ccd.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:48 GMT\r\ncontent-type: font/woff\r\ncontent-length: 68472\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=4,i=?0\r\netag: \"693b5ef3-10b78\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=znOt8aZ1d385XqW2Xh2%2FTm4uwkg7eGZuw93zjjC5e9E8p7O9ka8kEXce5sAEFBljZqww2TmzOHq%2BD33%2FE6KtMC4TJiRemn5Qnw4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9ba1e68faf99b512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":68472,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, CFF, length 68472, version 1.100","md5":"5fbc0fb0c325ab4fafdd29b2f9fb59cf","sha1":"408a89b5b49677373111195edb8ff0debe70790c","sha256":"9d0d6244f46671b719d4f5d739a3b341e1bfb835e5e9d94aeb26d8a92209ff3c","sha512":"af3c1bb1017591cb12fec601f3cb1d422a0d4b02fcce96b09a472665258507f64c9251e2ca1402a60af282314e01d74422b9ce3b2a4a8cf5b601bd0b68c69e5a","ssdeep":"1536:+c8xuU/Mh0R7QgCT5zOgddqggKzZqgDwTPXna6Bln+z:+ZPMqRZCT/tPMgDwrgz","tlshash":"2163022d26024136c863ca26f64adc0208b452f9ff513d959c33ee9ef527e6d6486e4b","first_seen":"2025-06-26T16:09:40.995831Z","last_seen":"2026-01-07T07:57:18.755475Z","times_seen":8,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/ABCDiatype-Bold-0e6f9ed7f4cce0e5bbb666a64c23ae075089d91bb5753727ea99dc8fe8742ba9.woff","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:47.964Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /ABCDiatype-Bold-0e6f9ed7f4cce0e5bbb666a64c23ae075089d91bb5753727ea99dc8fe8742ba9.woff HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/coinlist-0a2620ad3872299f031d5d02d8473296dd4870dda9252fd93ef46f44c7b85ccd.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:47 GMT\r\ncontent-type: font/woff\r\ncontent-length: 74108\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=4,i=?0\r\netag: \"693b5ef3-1217c\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F5wkr2Bk8wEUugWjY2SiXWAiG5ObYKmwjyOq1eurGGiUVebV3k97IBAy%2FuoJkj%2B9x3DNZu%2FDxasm30KoA93hc5QgNnLXmLrdd4A%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9ba1e68faf9bb512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":74108,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, CFF, length 74108, version 1.100","md5":"69b7d6464c57e5de004fe7929c6e180f","sha1":"a4dc1963f597b2319469cca38aaad8a90bf10892","sha256":"0e6f9ed7f4cce0e5bbb666a64c23ae075089d91bb5753727ea99dc8fe8742ba9","sha512":"1e23e6805faab78a38d2f17b189bc4bb19966318787269223e0dce4fec6a49ba1c64504497049de34798d35c763e6ccd850da2f828892c13bacf32e7a7fe6aea","ssdeep":"1536:u6DMpBdDvU6jWRjGiXOk03PxH7cCTPfYKH+kYroqocuVOeq1:uup6aXOkw7rfBHAkcBeq1","tlshash":"ee730235de30110fc483bc5b944500bd4e05e4237e7b7e64967a788c7e7ea6ea41a3b5","first_seen":"2025-06-26T16:09:40.963004Z","last_seen":"2026-01-07T07:57:18.746766Z","times_seen":9,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/coinlist_favicon-1c316680325dd190e58c670f171c950cbf19bbf4ea0e5dbc0050611891d4c8c3.ico","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:48.200Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /coinlist_favicon-1c316680325dd190e58c670f171c950cbf19bbf4ea0e5dbc0050611891d4c8c3.ico HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:48 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\nvary: accept-encoding\r\npriority: u=6,i=?0\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"2796-645b62d9636ed\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lfwOZwpDHMLphgCvakW0cioPjeoixFIdfM%2FgS5u57b6qDYeJ%2BG9Ujc0lqgjJfEqr74R4pDrh6NA7%2FxVWt50bz%2FD4gud7Qo%2FM%2FU8%3D\"}]}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9ba1e6912fa8b512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10134,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 6 icons, 16x16, 16 colors, 4 bits/pixel, 32x32, 16 colors, 4 bits/pixel","md5":"9347cf5ba52725e51f6ca13d8f84b4ca","sha1":"b5032bf073139380ee5f4ed372798bb67e435589","sha256":"1c316680325dd190e58c670f171c950cbf19bbf4ea0e5dbc0050611891d4c8c3","sha512":"63666cd512f2ed9b523f9100447734fa5e889f386b020550163bcce88a0c5100a0ad3253a354f7d79595fc1a9a83a7c09326f5bc28ae3d148d8e2040eb6e465d","ssdeep":"48:mg7LVnbXsaSU+4ldUdeye8aLCYR3SRehsP45KGeHrq3lr06qNmc:mgnSaG+yDKxcR2mGGW3lrrMmc","tlshash":"cc22fe027908e16fca60db7c4cdac37ed7267d29bd6aaa1b3840f37c68b3c468506124","first_seen":"2025-06-26T16:09:40.965099Z","last_seen":"2026-03-20T19:30:24.618814Z","times_seen":14,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run//secureproxy.php?e=jscdn/getFile","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:49.239Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"POST //secureproxy.php?e=jscdn/getFile HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://rainbows.run/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://rainbows.run\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: cf_clearance=2WHjDRdfvegO6SGyGWvt7QdqAaz3.uwevJGX3A028rE-1767772608-1.2.1.1-wWzbFr0fO7nOM_JmJMQP1vXPVUj3nFQRQGM37Z_IkyMfHkDI99O4GGMdAkLFeZmkOCKuDtwLpeFr4wX5nt8dHvOUSqHKzdvXBVYotx2MpX1C4fgFrUrirluarh2Eq2wQ7SNPWWmQvJvRmJ13pKSo1WEdxW04poPtJENv7HirDzCt10781uv9ffp_ynCAKOVzQgR2t_82rwfGReTUOZKftSgc16KFaa3WuyFZmGOwD8E\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"cx9kb734a8bvv82b7qyl\"}"}},"response":{"raw":"HTTP/3 404 Not Found\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:49 GMT\r\ncontent-type: application/json\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=raINwIx65DfOKNfKAjJDR%2F9u4AILG5XgQgZZLKJxqHQttYu5NN%2F7v1F6uxD3Jt%2BJld2rIyH7DRls9rhrhiCDz2Mpg6kyBPekFE4%3D\"}]}\r\npriority: u=4,i=?0\r\nx-powered-by: PHP/8.3.17\r\naccess-control-max-age: 3600\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9ba1e697bfd7b512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"PHP:8.3.17","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5f2dcc314f77c834f8a1dc091e77a698","sha1":"02ddc9e3c5026f1aeafa9098cb1ee9420a53e0f6","sha256":"ce58bf87319ddd62d94026ba708b11b1acdae99d417ad71e78385c5c48baeffd","sha512":"e5ffa46481a71e28bd2f56255d4e66e025bdc281820203e1f2e2cf92c43df8d5bab7824acf0942b788c184e7fcba92bed561ce9c6b96a30c508c89a6a6665437","ssdeep":"","tlshash":"3980000e0282020f0022a8b08ae82c300a8a038008228e280008a0080e2b0828c000cc","first_seen":"2025-12-12T04:00:11.329317Z","last_seen":"2026-06-27T10:14:25.971626Z","times_seen":46,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/019aea7a-68fc-7b13-9ba7-706e6b8cdf32-1764962873-73775d383055c5b08e3b00a3dd50ad9be91ddabd.png","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:46.875Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /019aea7a-68fc-7b13-9ba7-706e6b8cdf32-1764962873-73775d383055c5b08e3b00a3dd50ad9be91ddabd.png HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:46 GMT\r\ncontent-type: image/png\r\ncontent-length: 54198\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=4,i=?0\r\netag: \"693b5ef3-d3b6\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DeJKU3lBcQkvsJXPCBmjB6SmOcI%2BEKiTQslQDRIi4Gyy%2BzmtYlVxH4JLy%2FVSVnhYhRWbGT2jnaD9zWc8uKr%2Fda1miRw10%2Bg5pwM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9ba1e688bf79b512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":54198,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1000 x 246, 8-bit/color RGBA, non-interlaced","md5":"0fbe7ff95df58bb0ba71e3efaa2ef81c","sha1":"97d1e2109f8e9ee7e1356cbde7cc000ebf2d7e60","sha256":"0836873f8dffe25f022547e434a0ec8da9c4bddc59332a749cd61e76a4744a7c","sha512":"c0aae4d4c0534129174a5ab73f0b5d9172a2122e92bfd701a034ea0b0d627c3fab2ac2fc4cde0d4298782ebf63cea219b8873fb5803e1d0b0a5fe8d64559bac8","ssdeep":"1536:DW4YNC+g2F3d9i7nIc6OQD3YccdIed65Ie:6zNng2dd9aIXzY7d65l","tlshash":"0333f115e23ef091fc57f579e69b9f480e0a814d27b766142c31a1ede922c1336bbe84","first_seen":"2025-12-10T12:23:34.681727Z","last_seen":"2026-01-07T07:57:18.743989Z","times_seen":4,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":58,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/cdn-cgi/challenge-platform/h/b/jsd/oneshot/88d68f5d5ea3/0.3336387455928414:1767769893:Bdwr65Bcs6rpjrUcLXsFD5fcUzSuWkJGuzHlorSFwtY/9ba1e68568300daa","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:48.394Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"POST /cdn-cgi/challenge-platform/h/b/jsd/oneshot/88d68f5d5ea3/0.3336387455928414:1767769893:Bdwr65Bcs6rpjrUcLXsFD5fcUzSuWkJGuzHlorSFwtY/9ba1e68568300daa HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 12160\r\nOrigin: https://rainbows.run\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":12160,"data":"NgYuF-ihv6+7i77Dv$gc$giHsi7cbcaSvcYJi8cBuA2-zDgDi3cI-N-scgvbPc$-au+0cP3ZhWcaqZPWc9d-uyPcNp2LQc0$u4w9xyXNLic0G5$3Mr769c97AgX49wYY+8ivQLZcNkTYMvMu+dlFZ-j-iRCSgc1mgDca9LJhYzPhFpc+Fvl8mR8JZcALshRRmpl-V2UmCJcFJPcxgcDu$8c6OnQfPu+WIoify9iwbzVGggcFYDcigBPzta6U06cCzI74nPOmucvLaUJYYucFOJyvHu77YcwSdRZOoh64Ygc9HDJxZPROAO0IZhFYcAYgJzI5zuc+vI9J9aEZ6dZ61ZYchHPctpHHYc9bilIb0AvPYcp-QyzQ5Dx37Iv7yup-6aQ1RyHsjPhvHJnuaQaoLDfheuiispxNVNcivf02bNqE0ZrdfGtf1AGNFG+6Gwy2t0XpYcgmdsci1sbOwmTaCJlx8uc7$pL0fxsHqVP287$IlSnyfqFfXNnINGB6$c+9uGS6DxQCO+bhscib6yi3Dq+CXytcVbHpCc3P3EtZ$tHIt2eCq3i1M$lJmcBHyuyJlko6PDODL7o8uch+pvDqnmJnlRnchGsJB8F$UAxjXNc9gjJZAN5vLY06YvPOezWlPwH9GYAGxkUigPJO74VlgBcFHTrnRiU8MDFBs0OEhikTeoQv-A0EEs8uY7l3Cw5cMn+7GIetPTsqvPgmQJItdtPvijnJNNbXW$5-zxPeyI5HFdL$Gs3XA9VzV04IQZ9uvxDciMbQLiLzLkvHcLLSJ-sBjs$iValXuZv60ZCvht5DvVcBn99HqaC6CzgIzW2k8D9sdQc9G5xgvu300wiUCJMsWmPksiv6vfkcHzLTvgcuUQ4+ZUugvY0cYsgecHssZ91Jzi99iYN3Znq0+c5QL8i82YayDiLQi9uzc-pF5cv6i3STJzkvEAjDoW89mfHJz$CX6cG9vMGtL3Cj$vg9L5cXWF-Qp-LYHSwQ788ssR9XJz8lXMdRR9npdm8FqLR-CiTO8hXLRZxAhzd9upiZX9ACdHW-GA79qH1nO6mykjop4nO5uvUF0RUgHbA9Rx5vH+L$9E$QnH3zL$8-1jkoEAumFAnYMmUqGdv3lpc9hpx47i1SD69Hs9CcdiYnqbvvGuCLZA8JwLL8D5yJJZJLHn8vg+J77JP6viYvx58vIQkDfgmt1E61AXGlp0cHcuZ8i+-05y6uNNpBuNFYkUZ9AJmL99U1gHYhbYWSSqPSXYWviRczGT9bQSX6NbhxyrCZh1Tgt+cTFD$crfCRX+JcuSFuZc3PHk+ccLoSvg$$vLXz+vyIY5S63ssP-R9Bp4BsQxq4x1lvg0Zx+UUYgnFLiC96c5DW1V7cSvLt9IqL5iqzV5xzwUd9aDi-Ohjz5CEQzuz1f3s82QZ-8Zwbv9Jcz1B2VcLsy+zLuyzVRBwGl5$C1R1cvvr7CEMuQCPig$gO-sgn1$rnMk$TWkx$TLsgdsfWHPfdEnOoBgGopsifs2jgtpeSXc-efxy8EgWrEe58nG+mUloEZieGewcH$Gvr9c$rksYv$iuCuFXkEOBw2TyGRRbs4v7g08nOcoiYcVJXCeSuHi0v68$qcF7+Z6ZOV89I7ZXJQhyHz9FpwccXSZJsBx5+ocDCPWuTo7iPfY6ZTLRud8Oba1nP6Euii5P$S$bRdhkXP0HktWZuLPsDvPou$09--$vk-cs9sP+tLUf96OkslSuOOSRHJNZmcdOk97ohCTjsj87bk6YfqlZ6GRAhkS51LuW8F34TAkqnSYWUi7YPWJ1swc0qZAvh9Ja7czA-a-T04WYsDApQn$Tda6QoC9YZ5f-Wsv2AdWsYGf+3L6tI0yT-Boy2uudz9kfLzLcj+ctlabxWYQfiZtoYPnipHPx4bvP18hYQTv-a97cCieOgd4R9df1shW3sdLGcu9LR1U9AiazuuLof3POGOTd3i5L8+p6mapnSHOxnARytc8sgVd6bWDOuNZoSfAbX8+15stDuvLtb89ncgs5937YNgWydGSYcNFvcDNxkf9GgOLPXhPVZfIo+IIhO2A2E5aS8c0WBigssdc-xnRkkfNLoWHGYns7uEG6LkaXnjb0RLUJDd$R6MsPYtXsLpDYAUfiBpQdpaPIYrj1uguSvWucn17gpC6dpaFdPJrScIzgclO8vE2QdXUEa4bGa2PWaH7jEalxno95u17GoxYD3xXfDR25hy3hf3QPcYc4n9w-0Cnt$JB+XnhNcEGpWVrs8Lggl0brd-u5hXPzxxrBaArd2wupmu5kRujlLTRR68Dfe-qXVt3PJP6ZF6phOQbd7cFoLxvOLC648vj7+UDG7Yhs7uQ2nRdouinx6cQil3YhvNzOS1GvxPYt25A8nvQF$xnH3D3b$HH6J+1jizm$OAGpV2hYapQA9DZus+XYkcqc84sHQHZivi3PZx0CNgMnYmhYTS1s1C1aXwebnXjuMUDSLvizrjaIsQ0PJx-LudI5HOSsr166Nm0zEAhDHqnLU7RVwUH1fNLvacH86-o3iNIbacA8abVoL+VGZYTdxRLQcD9-lh3qiiIMhpJ1crJmnWwi7g5ZjZrdoy9hz1nPnOa3D7roDj6NrddDc9nZJwACWcvzJf0xLIEkv+$kUAwnPLC4jH+j$vsoCu0DxicRPHrIf1rfb8Bp0v2QLMHascNGa4DjTXPsR+0W$o773VsCv5IgzkXG1JrY9cv0Rl2dphsUbE7P2o9Y3y7wAoEjZ0D$86893qVc6AgbY5vHYbLq5p609E+Mr2BJaHivtbn8Z4-0$ky1fA2HEq0Xzlf-3ELHb6ngCEHYfX4XRuhtbsxJjYcVkx8JxD$2UkvHIa5TqigSCCy6pt-r9nIavQ2AJxGQAVxVJWC3CyIZ9ub8T8WgNMfbmP66Mbomk0acv2BmOz+JNyqi+6vyUwFgOut-Xcpy7RZhuq63rdzDCJmvgst6Uu-G$CUDy3hSzAA9VxichI6NHPQgNwRa9abcrUhuu-6iZxr625SFS6ddIs82emxkTXLB$LfSap1JezIfRskBHwvC1mYtGt7a0$LvXqSxo0Y-Dw6NoOF8UXfoiZtDlGnXQc65Z4BJGHO6ZWQiABvnNoE6OT$k4u$sd1koYFplW1BqivEYUHQEQMp6I+0oWhyLiAr1H398ShS7o-$LR9J26zey2nuhAhLDGWjbS0sJ9f6VO2XAQX6j$yGUupctprJfgQRu9lW8vpanFmATXQjA5yMkMqG7TR9CFDc8bfvAX9mPX5+ZeFvFYqHrs3vd1fH2ohYj3rilOoDef2M4FAe8+hpwTuZuTBC6G78lIUyOIV6f5MZ9eCY6kf$hPO3OmAvykDNu0IShZ3dhfgWGMfI+LdZBBuftnUDwZE9Ff38QcIXvCEpBnn1LB5u8sFdJ5ssMtkfLxgN$V1o4Y71SN2qx24ABZs27myG6QcOgbDu$ZPAiUfZBqJFIEh1S5iUfCI1iV$jnRnUqdo$NGBbN0PcBWSSqqNf7WiJ$qcdicszNrY2ygN-o3Ld7v2wLVu6676W+-SXo1ssNe4Ofio07iHWPdnYGiuiG-gMx1un$vozgcN1uCLwBpHCG5xu9ZvEBZswc1ib5uyD41PgsfPGn8xdiDnL9ChVYm5GuvijJuuMiczs40JWBNnJPfiTcb$rfb+LyG676yvTvfJsv1BA+Hv$N2xiozBNvUunSLL6Gpoo+kGQIP4DoWJJzbBf9LYYhHDrfa$ZB6ZWIbfBzZBssED0c9HwNj4A$F4y5Ly0yNfvDJhGPkIB91JHzq5Ggc4dDq4V5kva7uBgveDav-+2gvc$+Zz$NhDYZZ-J4uBA-koGQQnXY9uAJ0c4ciQnSJQnNhNUqk+Mvbylvsc1xzs2xZNzPWsd-i5jvMfSqVupNYH0xMPCLxoL-lgNhVJC$0iC434ZIkBoS1n2HCxsnLLq4aNfBvGuz8iY7AJyoc4HDfzpPFQLI3LGcX5y+y7XiD7b4UYxyw5x-ULh7sWyNePW2R9QcwBnYJ2x5eNuzOJi7wNGLocHDeDg+L4yHeh1WlSb9uzb7wNfI6LDitQm4Ncr-fopHWikvrYeYi7cBf41$5u8cfi7Jk7cBNPbfpGW$BQNnwDZzBQhSv4SgTa274Sn2kcvgu+YsPI0hdGTWiWvcdiQ2mQR5uz4QkcLseDb9R7icb93x3$87zWXG7-2itLiJeNa6TzDg0c8cCu1SX9eDTPIZNY4vbqvyzNZNn40iI4Ufioznsa3WHDLslir4Zseh0xIZ6H4cs5oiEGic19+L$7eWWcRQ44Aim6lL02WJWBhDbxOuAco6CQiGVaWaq7sdL-rS9d$aZNbu0cXc7jj70nivTWnId2vNtuZG5oVu+olLs41$eHrWZi72$cOg1jSyw+zDfBvWLYzdVfZ4xP0c948n3LD9ZzSosdnSsud5OBzfbjJy9WJa6umL6HZGOdZnR6NvSNH-ISpo7h3B9j14A6E9CSkLi7DPzc1jLardPvZsi-jWgz17NiPaWxtu4iMBYIvLg+p+76rdDQy4c+rdWsbcSqUfU-rjwBVBdAZG0-k$QDWdu5djn2AjZh$jBzvJNiQIzPBG+iXfBzINbx++d-jJOGqHSjsFABZANQNDn6OgVP8hoQ3uGFpiRiNc5WSDXaGgchzHhi0SdDc4HFg+bHLYR-xAfLd2L+RGzv5$d2qd4PscLzAi0$CAe4NP1iV4GAeo-Df-XcGdPa-SBBC5X$qDaBp2$2NJCHba0Fua1vI9YsPgENBQW7TGDdqSWvSDJdw6c6HzjYRcwfy4dGJ5bLOu$L5cd4CNhPmPVBtiqv0jY5mYBAVHeSHobI15$gjI1pmNj9Mfl4lA5D6up6hcHBYxSFZsTBZWxx5c5-t+usa26GYyavyDwNtAFaBGuI6Zhstc0iXN$i9+Dyf$ioEp3yLs$LD26NYGT-HS6Ldi9Ac5$jenoJcLzgVnOJYdi5Dor-+57i6OvGII4aOgML6LZSgH4ib-yIioDLdL8cbFgG8phPcH87Yu0AuWUuF4SWZpSSqA2-rjhD1jeIDOgvRQgYuugaDOdgiBVJXXypH-xGRo1Xn$oSvIvPRQ2GEiRoeAmdQOcsnJi-EZ5BNcHwzPLLk6HO6DU7faef3Q-DfshLxPUFs9u2-SvwiFUWMY8OhN9JCDTycHswlfPuMfkiHGVo8IVhvc+BXJMFk5SOsQVwkv6d5XW9tuLDR4LjTajOd2zP6PnJ1F4FzPspn-a5ZB57fcNi2jdXEQLBrBqNpczcLufukO6uWfIOtOBs+6VIBz-Wd2z25auAwN6LD-XAAQ9$1iq-SSBjNDw6Euc6u6viE+-do4udL-Qiz-VhVnUgCufp09XYt$Qd2paNVn6PUaAvRQioRS3grN6Q6uPIeyjya+9Xf56wza6aHFy7U7uuYpXi865LN5sjq$6A+Wmyz9i2ypJOF+XJ9puy3gGPlBIcGPVw1S-OXf4JevWx2G2WW4dBS2ThPje5HpWuVHnh5fzolXYLCzmzbaHWuPgzHvpcZIA2CHNcOgY-S6TBgQ5+Car40J+wmLh-maWIga4FTa17YsVWSoYIwVj5q6Uop4hnopudeDpUD$GL02rpQOACbYfzJVvFZBsa$cdxrfMALsPgIDtu7HXgjyMu$DyHmBz2+-jIp-1g040QyaWJkwq+5iyPqC5Jpc2+8pUofdXcHXTnvHEnI$9ayGHhrdDBZWcaz21L1uML26nJWBXUh$y9ZJ2irC$hO5rjusWWsswNNPMpfisnCH1SB-c6hzYSsZICBUsicUXY34GCkiDg1$lSFvYL5LY6BokvVCOugzEPFwe-Mxzg1dm-0uEju87wnXWxhDhUpwcjPO4XUX8w2D-V7LNioi$6aA3huji8Hxd+WOLpM7CBbIwyP4by3y7jWjuhEAZ5Dgz2ioJ5g5B9-oNPcwwIBQ7jjjvGL1oc5c5AoW3h6H8cHWXFhDWz5prj-HxgAcaHiLmvqV9JnJa+Y9rDa+7UGChj6uT655xybjy-1JWBbUjIx+1Y5vjc-2Ujp+dcUvlLyyhxGcz$T2rFPGlNC8sjka4UjNIZ3YCmF6mie7rjT+UzQVlf0cB+TXrD8UHDl4AF4ACU-P6NNJRoLuS8Rz$QiAc70JnQ97hCqCjm$iFmz1LjywiisUQclAwFTmQDiwxGSHHFmAjI3V0VW$9kio0-hPXFJ5sZempo5cJ8dcxVJgBWOa+WUFAp3kpVZN0bXAVPd8QwlFxIg2Zg8mxyz9XB0GNii7VnvVANiBbw4wNbLw4NxAdUroDpjn1LioSnGS$SLiimgOXYPHxIAjpmy40$07+ns+oa8XhBA+2HVuCL8+iCvL3YVan5BWDUHD-1ULeFahmARUsjvQ4Uf8WU1w+aFdULvNvGxa3NVy8-i18IgIImTFshpdWs$55DUdsjqFeVhwpM3vXBF-mwtn47L2W$mUBnjGLi+8QcMwJvWwLccuIhw62Wpc84lAS5uz1yd50H1cn53YA8bYwL3p6NtL+wIUHsn873CuMSuUpavVpbxXW11iOc0jA3wDRuuuMfYzuwRIMi2wu3hPm+Z1VFOBIcOmyC68k$78OgiN1n3oJjq5+cGuQirpWB18hn7UU8o3BPT1x63XgMSGLwHt-VW2ijVwzPiwiiJddhNfrDgy29lfN-L7TVTXtAXcCD-32vLs$hlY6aBnOSjU2kOmrjvdivlAQ4UI732M$N1IBcW4DPvczx82fLBCR+Xn+WwalQ4N1ni8nSo0s2tjJjUq6N8LZ73YD1gFW4OC8iYp3+X3F360I2vO-Sq1MQCJFwMCU1RQ9jinLnDmS8$D-+Y0Q8a6gVFWfX6hIS$6RXJ3RAj4jJdxlLi4fcoV31YuUPMPD$PujdFovGoA26ukf1LOCsym-L+i1RAWWxNWVG5dCBZRlkutmuHFh54hLkNVUt9FGajj0nNpfDGDpy7Mi1WsYd$iN4Q0uOgGZBq1eDTbm5OMYIvJ5u0JZkWAPVkugS4VrwEPspNN$ArdrF20emt7EIRyhm9vMuhgYLlS5fiAfCLFQy1j5cTCj$ghlfnGQbc-IZXpGP-ve1XAjXcuE8cGtC+6zce5F3D37QPuOMOVHnV$NnlbE7VD9AW1F+TbI9VLQMhrpDcjn+dS4VmNkcA8PwqPdkDs1t0032-Ta0drwlux46FbCLU9pU2iiAHzwYnfqrWByVqRYLwp2iovM6kWcAF8o4EqvVxR45+drNgPZ1hIIvZz$NhBbYJNIGzk0znHexjaStHB1FUqDcC0AO7bap9Li7RjfJ2afixW15GhOgfstc2iuHlYoU80v3ItM7N0eYAO$x50BDNImTAik+Ey0H$82C6HxClLBMJpCL07Eja3E9nIajUj8jxyCbW41joNvGYP-HbmZmIIsmc3LD1mz2TSESxyyFcTdHA+zWRQvX3eRewTscPXRLxkM0kBtt3S-FLIOCg0lgGnk+qeuylWD+2Q6LFFfEG73wvw9dTN2rZnZRdDO0n12iXQiv-pHD2wmYA+fWcuDekLhyWQX0w6IetQ9YLyGq6Qc6+f8t7b4+oinUTCtd9nS0YUYsvyP0cX8Zyvoi20w7kC7g3LF0SHWI06qFOxyv27u7mktLtHcRO7YZXga9FGxuU$FfXiExh$Aud0vNn1bEAz3GkZmgigIu5Z6uxvaALOc$PI8hGfM8CZmhIuAPkk1BxyiOc4JhVTSRZIOjJcIurswB8c+0f8cdD7uIJvYxTQpI9Jg80sz$ZLLNnY-WuUAfYNWc+YNY9$Ws8Rk3ZU+ig4-YZvYuy-bshcL+9b-HNbv1q+ugfTc-5jEcGzRDuunpAzsy+uyvsYsRN89YDcz+ZXpY5HN90xgvggLWvtdx9ACcqvihOPA8cW9oLLgw6rZsHnRdW9xvuWsDzu$vxZOgPWLSsmp6dLFjIv-6ay0HCPtEcN+PiJX+cWVvZCuJeuq6kh7yNbidcWuJc9JXP68Zo+CHEeYhAPtkWQ9HWzb8JzTb8+vc$pDBCyAP6sXeLD8NxnJhY9yULHVWXLwJsy00xRzaLqT$Y5DNWxNYgLbsmy6$v4HS+dWiYT-YtQ7WOitLB7ngA4NbcyzicDt6mcW+Xs$s4HFyYYX7CquwfYz0LcYTYYfvZ-1RjyCsmnPG23zDzy1n9TyfyA-27z6iT9XBCXia5wyLPsDkvFz8lzPhMZ3Atddzw0sZHiYtHtsDRVx+eu67cHWx9cpqqHHrZTDh-m8a4QnuwWT3vb-4vHybzasbe8QcS8W2T7sg6Phqu0v8$9TJY7saqy$UtfuzC69c57AJd$gOY26nXf8dCcH-yHz$5$fWtFZgv0JE$kj69NWvb-a0iYY9kQd08Rcs3iYTsz+cB9bvZzhX9ykP+N9ELyH+Zg6X8A595fNRIdxYkRsHcjc1h6uEJn$C9fuiDqZJdJb1t6-Jg7qga9Ha162-xI4q4etgN-mkvrsLZmcW75v08i3vSvTcs9FY9gun+bLbAhMch6U8ovDLIrCc9nj+x1NPbtHxA8+dZZQvuzOz$7TRLxCUcdPT2+bHA3O9hiXqPgH9+UNwWzS1YaJBhP088+IzoqjJuD9R97fBfRHisV36kuF8OiDg+2v9v603wi6hc3JGd9q8pCwGtYg+cHrLSOs-QGcxc$uC5vDJ3srbrZr4JiYg+uI7p+Z+q908aL4hfLFXXv54FD+ZNebIu+hsTt8aHadgrZXpNSaa-OxbP4JCgCTi9cgiTcRuf7WQZPUUzG0HsMs8m1WZYqzg8WW+Fz+4i8i9ht1x-J5CLu0GIYA2ssFq0ZcXztcYDDcF7WdGUf-DPDQkGMC$V84FJrWW9YZbAJyn1PAOJSSAF9c74mhRu0giUzZvCB5dI6tt1PckJnDo1yPf-$FmUqc4BcaExgFYvSaPZaX3FNZ+GQydezC6nD+yzusH8Yxru3xvY9q0LA3+DHRFcsYP8H1UcccPRyc$i7vFc9lvBCpSgibQAyH-83GcnDJ-iR9dMCWoa8RW2q$ips8qfJL4COu-hlDl$+HYRssLDi0u-67EjmCIaAvUFbuoFSJWb+Iu0VbFOItdin6lucusXWPWBOoWGEGOYZX7+aj6iTGN943D0+vS5-LLhXF+QUcRpL5N6CYducTa5CfPvs+6cYvAtiiSZPqtHxpWEjeCUi2GiYsSvAfhj0szzIZsb7o9tg9LPJTc+1vAfO8QfCG3pfmlsDTm1nXbCsOgiv9oArW$y8ltgx28ICSaVGE89Psvvivo-LZNDrztijkCs-8ckDwG+QYA9VQ$c6gEUw$9aV9dvsT6U9fatQvLLSY2f9VR6+4QHhCcEu$HYQS+ZP-ri1i6uv3AuUQZeulcfX9Y9n9EuEu4HHJcP+5x1cp1zHAufhxR+xfuPOyeXtYCQcNPiYSJ4Rx$8Rvqh8uyfkbwRySQqhM7NxY3wxZ2udPj$nDhufjYAL8sqiWjwcx$c6-QZOY3DkWYV6bujcnYBZh3AV6kC3cHRfBx3XqvJi3vOgnD81fC0ycTim3LmX0byaAQzdB7chI-04F+1bssPVWN-JV67uhcH2O9h8+7+aa2js2Yckbrs+B1iNA2OykoYVfw9ispq5hGRrT32GLd32hP0gGMNVazqM$BhLYNGIBAojapQhB-6SSFSr$C$gYNjNjFOmpiOufM+3a4L2U0jBcyk60rHxIL1iC$H3vsfsA4GbzB23A$skktMSMzC$3oAEh5yALOdZ23ospFED+A1Zw2huJTz9v7uNiMdL4q35ef9vsu5$QcrETS8HZGjuxblc4keAIgAZU2YveR5clrAkdZ2B9ivO2-7Q-cZgQ74s0EbZkdD4xDuPeCkNhuqGjhQ7usntYhSbs-Em4quiI9DfLdxuHyzLT$Pk10dWTb39p0j+3ZWcVuz3s3am39iZN3x8swcHSaOmDatyQv29GslckXhe4d4l$YlmoQ7AdhoJq3z+09iMznvgvu+1zuLvdFC$Q99a0YOy2b-t2Y-pyPj96nLdNYehJBiuon9pZXJX6wiPgp6vedZ2V6sg9J8sk9FMx5DX08gG4kqjXxM-Zjcup4PiFcxc44fWO8VmuA9U6dcfzJ1aZtjtYdWDfXDR$xLdEuZ7dPnyi7nZA1uEWybT707coql$7J40waCsb5qpSwv70PZcRd-$$vc-2Gk0a3W1Zz2vwXB0cqhbeBwxinf1YyOODPhBDg+n39rfPqBFWJx-Sinuz$HNAb2nDk15uz5soAOYrZq2RiSbbFANSmWE$kkFbk3qqSqiPfv7Hpnx$w$RsYZA2ChLLddgidnoxkxHntFxPZAXEbCAixgc-SnDiufHC6JiceSZvoGRcpdHpy6u3Tz3zsxvisdZ2edZUSgHvLNQ2E8vyUNBAHCEFW-w3hih6xBdDqqhO0zzJoAHPsS8czA79v309c9Oj$2AO2kkACuq$gEnDP+0o95S6pipuh$0NmF$kjd4f0DFL540HkfPE4QyYGk49+mtAmGsDxg8q+08WO0godez+L3hQuQ2nMZo-iq9L+lBgsHZ2Lh407u-jPX9pIJiV0Nn5cQcSWHhYgGvnjaanopZjCNAoPOvjn5EcGSI03d1Op$ojCn6UFY9Eutcb8t20bYvbY4sIpZPGXQsQPWdz$P7Bsi8ooD97vsO77QYFF5bTjszNpjRxsxBSGdPIQc52h6cMDnjxn6hei51lFbWcg2IczZcbH5P$je$BXj0JXRj1dpCJhTToWPvlLSpW2dhEoXbO5bdip2EXVNbMYFnojzS-pd5J$umbBH9ShULYf97NnodQSyU7Tb0Hm1DZ8I74OxovYRnFdvILATEJXGFnUpoS5EAztRGJiZGtxLpDEbsRjPkj8g-pLSXEol1iZiRLpqEwY8rDmOMIV4VGTTHuPej9vcYOEnOq-PxpsxvUVNWcpunZXJxuU-+TEbkbApsxr-qnXuHdv0-Mn1vLnkL7b-8G+nDhuo$CAYbApWxc4+Lo1HHkBOXNyQJ+rsltC$p1xR8U2AZGw1Ap0xQkwLTRagnwDiLwpuihYoJ3-AANZ1mcsb79cdFUNLpEznWRDMAFuNkb0zSqO5bXFoxZgqnkH7-ZNOQxk2XaauFkbWXOxWh7R51O7P-nLnPkxfPVmJ33XsS5UdQs97ZIgXcSv8DQs9ouPRXsSX8BjW9puM$pgSzub+JXpWPLXtPtYGh5EHdbzw7S6bB+WPHokSA8ITWSFsPi5kGOw$IWu$s2HUkfJGIwpuOXa83PwaxnfbG1v$oUPaFoIB1uobhlc$xXXo2dRLhvuXM+FmPo9J+WhH0bxwINTd7u077pIwA3SkJZwhNRpknw8clbqOXa8XIkF7oQxYZ0EFIk-i0Y9ZU4ToG3DeSdqZZtLba-4jycfNLu5G9572ZlyrsWgXgFWYf+op+v9cT6YP9RvSFgIkSb4$o18iHPIuBykuYrdlXXQ22XZWdciNJWYQxNtupdfRMRD$X9Iu0U9w8p4ilwZ5eA1453jXv$sAz4JfZ+6D9vscccBtQHGQUiAcB9ssA7v1bkcO$FVYyiZvaiMLg9-D5zfh+PzAzgZhUrsNoDRchU59M9T60fnjPccv8Jx3CucJLJ9SZNJf2xhiaDQsskiZOnvH-Qvnq6YXgx96PQSWF98gfkabtnMJc9ZpZNcYFHccPMu84cc9Gf5dRQu9yzXOqLacQcfvxwO7xuivPhRGHcOlqy8UQ5qRLM$s69vvVysuRehYwHc+huRLMwcm+yjcHBuRIb+c8Nv3L+52RZk5E-zuPi45dcNctR8jM$Vi59-JJNGi1+gVHc-TZMnwlrY9cEgJWT68mRJvDanct3QZFG-3OqLIcccbLf+fvS5cAQs9vHMioV8cmTBHfui6uBUGgeTggt8CYvvsUccAIuvixZf+uoG5cQsTAvNiYGF4VlYqvi97-lQlYMpT6NAx++oVAYA9PR$PznQU-WLJBhY95f+Shqk9IPXRt8CwkgUmc5stbFl742ZusvzHJmJb7sFDVA5Y9vUL7Cyi8LQuMEyCstRZ+$V45XcbcfmogQZii5-idcc1Cuvsiws$EmyNa6ZjnswYb0Vc6vD2yQWjqxYDv9vstY9-WfHs6yNh9UuXi8cii3cdc96ShiL4$H+u2UGA-yC7c$H6JbpH3uYjbi4Jcc6sOVyvY9XVhkLwz8uh5GzcmPaoOWDVu+ZArCbXczu-ct9fZccF2U8ucc"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 07 Jan 2026 07:56:48 GMT\r\ncontent-type: text/plain; charset=UTF-8\r\npriority: u=3,i=?0\r\ncf-ray: 9ba1e6926fafb512-OSL\r\ncf-chl-out-s: Caq4mcRwxwDv+rkQzpLkSA==$A253kJHWVSShSSxJvZWH0Q==\r\nset-cookie: cf_clearance=2WHjDRdfvegO6SGyGWvt7QdqAaz3.uwevJGX3A028rE-1767772608-1.2.1.1-wWzbFr0fO7nOM_JmJMQP1vXPVUj3nFQRQGM37Z_IkyMfHkDI99O4GGMdAkLFeZmkOCKuDtwLpeFr4wX5nt8dHvOUSqHKzdvXBVYotx2MpX1C4fgFrUrirluarh2Eq2wQ7SNPWWmQvJvRmJ13pKSo1WEdxW04poPtJENv7HirDzCt10781uv9ffp_ynCAKOVzQgR2t_82rwfGReTUOZKftSgc16KFaa3WuyFZmGOwD8E; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=rainbows.run; Expires=Thu, 07 Jan 2027 07:56:48 GMT\r\ncontent-length: 0\r\nserver: cloudflare\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=HMtGlvnsgKm4j0mzgzCtSoDY162cPjiNGgV9%2BaK3jcg5oBsemaJ0S9%2FvpVM5uSS6pkR7qVTr5%2B9GKIxZL1DM2WH1nXnNVB1nc1VKdlkURe7pT%2FNwY%2F5rF7updeqisto%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri, cfL4;desc=\"?proto=QUIC\u0026rtt=3081\u0026min_rtt=623\u0026rtt_var=2576\u0026sent=6328\u0026recv=189\u0026lost=28\u0026retrans=33\u0026sent_bytes=7415472\u0026recv_bytes=28653\u0026delivery_rate=54382307\u0026ipace=0\u0026icwnd=12000\u0026ss_exit_cwnd=86906\u0026ss_exit_bw=41086702\u0026ss_exit_reason=2\u0026cwnd=202270\u0026unsent_bytes=0\u0026cid=e1c4c3c3d1e2e40a\u0026ts=2022\u0026inflight_dur=784\u0026x=55\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-07T07:56:46.234Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 07 Jan 2026 07:56:46 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1VV8pyrrrlM3vPKO3nFaJWNnM0QT01i6LRfJ8bJU9jguGODL5cjmlwgopdNZ4EOAoapzZz4y3m9jppJsDSmfXYSUdScLe2H4WmVz9w%3D%3D\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9ba1e68568300daa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]},{"name":"Ruby on Rails","description":"Ruby on Rails is a server-side web application framework written in Ruby under the MIT License.","website":"https://rubyonrails.org","common_platform_enumeration":"cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*","icon":"Ruby on Rails.svg","categories":["Web frameworks"]},{"name":"Ruby","description":"Ruby is an open-source object-oriented programming language.","website":"https://ruby-lang.org","common_platform_enumeration":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","icon":"Ruby.png","categories":["Programming languages"]}],"data":{"size":97636,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2055)","md5":"fec5c9c58dec10cf39f55a062594af7d","sha1":"2eb23ca727e03a519856d7a4d23e825e1ca2c87c","sha256":"611836cde3d7a4b4693210d92a39b7bae63c7ec4a99ede1bf6576cc460c978f5","sha512":"32bbe03c98b5d107e6b2b30946513fada978416f163bea24e6f6afa18b961eb68ba056f4bb34143375ce0dad1a7ad71a4beefa22b7308f8c9cc696a7f20a80b4","ssdeep":"1536:q9zC94g9fMw5SJSam81H6VgyFy3vyQSwx/4:WJSam/69SO4","tlshash":"0f933b3036f4311a609342dbf9a15f067ab9ddcbea0d00c4f1ac4ba44fd6e88a95797d","first_seen":"2026-01-07T07:57:16.696487Z","last_seen":"2026-01-07T07:57:16.696487Z","times_seen":1,"resource_available":false,"data":null}},"time_used":215,"timings":{"blocked":68,"dns":30,"connect":1,"send":0,"wait":70,"receive":0,"ssl":42},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/019b041c-179c-711e-bec9-2e731310d6a2-1765300508-d12002c95db2ac531fb3756137bd0dd4e47d58f7.png","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:46.876Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /019b041c-179c-711e-bec9-2e731310d6a2-1765300508-d12002c95db2ac531fb3756137bd0dd4e47d58f7.png HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:46 GMT\r\ncontent-type: image/png\r\ncontent-length: 3990963\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=4,i=?0\r\netag: \"693b5ef3-3ce5b3\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Whg3bDSVAzYFf4QUkGU18Wx3n9ma5mggoF0kQcFsrpLDc%2BLKUF3BJGyQQZ60lckey3xGOsm2tytnUUQUSIjLCFb71IjxTsKPKoc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9ba1e688bf7ab512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3990963,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 3600 x 1992, 8-bit/color RGBA, non-interlaced","md5":"5e105b7a93e70a3034e485f3ac17e2f5","sha1":"34735a84463134d920b6102108e858c223d24fb8","sha256":"c35532ab133543b56e0320a08185c123724874aebe89060d671afeb4acb77b3d","sha512":"f338fde80055f70ef081dfbb2fd74e92b39ac3d770b559e21540184b2b017e708d896668fb7b8b81b75daf8f7d92fe9dff20dfb595501974272de21c841f9f44","ssdeep":"24576:nR3TxM0TyTvwBgN1kqE7da5lx69tDPa6emTtcHKWAiBUz8NkO8W:nR3TG0TMvwBgN2zavx69E6tTtFpcZ7","tlshash":"a0252337963805b6c1b8d73299940f5266f82ddd8bbe383110c2bf82673a5ed76386d4","first_seen":"2025-12-10T12:23:34.676582Z","last_seen":"2026-01-07T07:57:18.746017Z","times_seen":4,"resource_available":false,"data":null}},"time_used":672,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":617,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/019aff0c-7cd6-7818-b761-02e28d43fd70-1765215599-4269cf9c5f7b5ad97b0d7a3d5ef5f3fa6920a841.png","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:46.881Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /019aff0c-7cd6-7818-b761-02e28d43fd70-1765215599-4269cf9c5f7b5ad97b0d7a3d5ef5f3fa6920a841.png HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:46 GMT\r\ncontent-type: image/png\r\ncontent-length: 681336\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=4,i=?0\r\netag: \"693b5ef3-a6578\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iPxQ%2Bvc1aL0up%2BF8N5uCS2bxddAvBjrxN465GweO5RietXljuL9ElBgDc9T7664CM57wq%2BLphlxnoJUntcSD8LdedUTR%2BHzVe8U%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9ba1e688cf7db512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":681336,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1600 x 812, 8-bit/color RGBA, non-interlaced","md5":"bf83d9239913fe5d4db91fdd7690b0ec","sha1":"9cb371dfaf5c4cb4972897baf7c289cb9ac4bed9","sha256":"f6b96632a1821d4b658a4d68ab7225ac848aa4b234554a19677a68400581a70e","sha512":"be999e6702178835da7fd9c5137c6e8eee42aac591a60f1bcb7e51597b4cb91047dd7ab9587058044248fe9190d79b89bb8d84d7b7c7ae1d2839417976d5cd74","ssdeep":"12288:MElMS5jtN6jLb10wx+EDMvLqrhx2OSmBdklLBS+GfeODL4XfDeSb4r87Rro:FvxtgHb2wx+gELyhS2dklLBS7//4f7bY","tlshash":"fee423e49476d15e4daf553c3fc84f5cec85b1af4c391e25c6d0aaaa808ced24f942a3","first_seen":"2025-12-10T12:23:34.709941Z","last_seen":"2026-01-07T07:57:18.749966Z","times_seen":4,"resource_available":false,"data":null}},"time_used":360,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":303,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/ABCDiatype-RegularItalic-a1bef2333bff74c8c28b67c43a89c597197729313bf3610a6f7cc6a8f86ac1dd.woff","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:48.048Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /ABCDiatype-RegularItalic-a1bef2333bff74c8c28b67c43a89c597197729313bf3610a6f7cc6a8f86ac1dd.woff HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/coinlist-0a2620ad3872299f031d5d02d8473296dd4870dda9252fd93ef46f44c7b85ccd.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:48 GMT\r\ncontent-type: font/woff\r\ncontent-length: 70992\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=4,i=?0\r\netag: \"693b5ef3-11550\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IFnUu3cWjOBYt0kRdNMuejeRPbBqsmIN743hZfPFKlpK6h%2Fw7jis1vGptwU1pvXO9mO9UXkBhEQwYvq2Ao8cyaAcn1hzWX%2FnGgw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9ba1e6902fa1b512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":70992,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, CFF, length 70992, version 1.100","md5":"ccedad7e21671e44a34a8790caa0ef54","sha1":"7048c4c7cf1d15652506b8459ec2d02b8faa575c","sha256":"a1bef2333bff74c8c28b67c43a89c597197729313bf3610a6f7cc6a8f86ac1dd","sha512":"e78db338995a0d8ef6542bba7ff8524c91cb346bb48aaef281c157f1460c7dd79d0bd1253c1d590cfcb68c9119b7271dbc92909f08cceee429d6d0afabc599ce","ssdeep":"1536:YeW1+fGo4j7ZGKJCto50FsJg0Tf2CHjJETPyu4xMmlfWnX1:YeW1+6PZBo+g0TOIEr8xMOfC","tlshash":"8f63129a680ed2bbc793183bb5056c798cd0c38e929615bfed27765ed08c948d0d1f2c","first_seen":"2025-06-26T16:09:40.990754Z","last_seen":"2026-01-07T07:57:18.751377Z","times_seen":8,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":54,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/ABCDiatype-Thin-8ed7f13c4ea876d0302869e13342e64cc78a8d83f28ba0b2062c2e41eae07058.woff","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:47.967Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /ABCDiatype-Thin-8ed7f13c4ea876d0302869e13342e64cc78a8d83f28ba0b2062c2e41eae07058.woff HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/coinlist-0a2620ad3872299f031d5d02d8473296dd4870dda9252fd93ef46f44c7b85ccd.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:48 GMT\r\ncontent-type: font/woff\r\ncontent-length: 65404\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=4,i=?0\r\netag: \"693b5ef3-ff7c\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D0BUdd7rXAo%2Fy2cTHvNfYiwAtQDVfn63zX0fh2xVn30RFwIwovwkk54bdKmX%2FnYuM003EZW8BwMNq6zLxfH2FsSee4nej5MYkeA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9ba1e68fbf9cb512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65404,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, CFF, length 65404, version 1.100","md5":"361d05e5bf722bb92fdf48eacac65922","sha1":"64dedb04503d71a531f482cef2f640081469ac3f","sha256":"8ed7f13c4ea876d0302869e13342e64cc78a8d83f28ba0b2062c2e41eae07058","sha512":"6865da972e1c863829de09960e71748ace272146145543fae537b1e533f02a8b69161478249fbdb454c1df6157633f0598ee1fc67c56898e627ade6e15da9134","ssdeep":"1536:0Sqct8pAjF+EfxbEb793hAFsQh9+q/oBEy7LTPxcCZ1De:0SapAp/ZENxpC9/2E8LrxcCO","tlshash":"4d530225cb402bafc983e5e3c65a6dc6b54af6e37187c9f15c0864bd52a8e0d74e060f","first_seen":"2025-12-10T12:23:34.686637Z","last_seen":"2026-01-07T07:57:18.744516Z","times_seen":3,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":50,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/fontello-f0c4a6decc9a0d895b0fa426c51b37cab0817575cb33d031da47daa395e9e8a4.woff2","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:48.017Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /fontello-f0c4a6decc9a0d895b0fa426c51b37cab0817575cb33d031da47daa395e9e8a4.woff2 HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/coinlist-0a2620ad3872299f031d5d02d8473296dd4870dda9252fd93ef46f44c7b85ccd.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:48 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 15080\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=4,i=?0\r\netag: \"693b5ef3-3ae8\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=u%2BulQ%2BeSTRjYvfRPwA5EENDxgZty0EujfrYYMohqDFP6ayXIXexWk3hZS1SDF8CWRfvB2ATGqgj3RVLRG2w2rW34zTHqJtJ2Tik%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9ba1e6900f9eb512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15080,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 15080, version 1.0","md5":"108c0f21bf760ed98e4f6bf9f002e92e","sha1":"c2a6f08e2f91b019a845a20815f1848122c2492b","sha256":"f0c4a6decc9a0d895b0fa426c51b37cab0817575cb33d031da47daa395e9e8a4","sha512":"bfe6acab8513fe83cafdde07358def738e3a5bc137aa122e4f4e83f9eda70ad8636e1bb6da0f97f4cb8592411aa727feb7f3c877875ea85a7802986cd3cd4b52","ssdeep":"384:7hHnYMAzka2rMed2tLcLpQuD66AOa42nCiqPO:7VOzL3eduLcgjL4yCw","tlshash":"c762c02f7a9e9580f9fd81f5870b080d1fe2fc472ea6810970cbd8967a970c962610ce","first_seen":"2025-06-26T16:09:40.954898Z","last_seen":"2026-01-07T07:57:18.755907Z","times_seen":10,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/secureproxy?e=jscdn/getFile","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:48.062Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://rainbows.run/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://rainbows.run\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"cx9kb734a8bvv82b7qyl\"}"}},"response":{"raw":"HTTP/3 404 Not Found\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:48 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cRm341ENr0jYmFssEB4x489Yg0ncz97uVcZiPObt1A9NBC445SDotPNhdTYjUN5zLeKQ7%2B20ntE03sGSJSyT9UrEkg7wi2P%2BG8k%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9ba1e6905fa4b512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1128,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text, with very long lines (933)","md5":"45cba35e337561a48bfca74db7768951","sha1":"706433fb2dd60ff60ede99fd992c502609eb8521","sha256":"94c4d2adbbf7639a667b46efcddb949be3425ff4a3ac96de32fbf37fff34fc7b","sha512":"a2a343f8feca3d60e9284e3853a4df165c2e6859980200687e0603da64dbe495552fbd5e404d19d5f01fc71367d8f104fae4465577c598e1285f9bb522c74fa0","ssdeep":"","tlshash":"402130bd7a165238c992418231fee7ac3d3120717a029084d6acdc299918e9b08dfdbe","first_seen":"2026-01-07T07:57:16.701959Z","last_seen":"2026-01-07T07:57:16.701959Z","times_seen":1,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/secureproxy.php?e=jscdn/getFile","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:48.444Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"POST /secureproxy.php?e=jscdn/getFile HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://rainbows.run/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://rainbows.run\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: cf_clearance=2WHjDRdfvegO6SGyGWvt7QdqAaz3.uwevJGX3A028rE-1767772608-1.2.1.1-wWzbFr0fO7nOM_JmJMQP1vXPVUj3nFQRQGM37Z_IkyMfHkDI99O4GGMdAkLFeZmkOCKuDtwLpeFr4wX5nt8dHvOUSqHKzdvXBVYotx2MpX1C4fgFrUrirluarh2Eq2wQ7SNPWWmQvJvRmJ13pKSo1WEdxW04poPtJENv7HirDzCt10781uv9ffp_ynCAKOVzQgR2t_82rwfGReTUOZKftSgc16KFaa3WuyFZmGOwD8E\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"cx9kb734a8bvv82b7qyl\"}"}},"response":{"raw":"HTTP/3 404 Not Found\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:49 GMT\r\ncontent-type: application/json\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=997SCHtENpoVnRHNCzjzsKncTD5Px%2FjNC9sVdv%2FEFLXq90e5mXoPaW814wwWTEiJWz6UT5NqmdbnErQY5cltdYRSpNntTTZlX1s%3D\"}]}\r\npriority: u=4,i=?0\r\nx-powered-by: PHP/8.3.17\r\naccess-control-max-age: 3600\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9ba1e692bfb3b512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"PHP:8.3.17","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5f2dcc314f77c834f8a1dc091e77a698","sha1":"02ddc9e3c5026f1aeafa9098cb1ee9420a53e0f6","sha256":"ce58bf87319ddd62d94026ba708b11b1acdae99d417ad71e78385c5c48baeffd","sha512":"e5ffa46481a71e28bd2f56255d4e66e025bdc281820203e1f2e2cf92c43df8d5bab7824acf0942b788c184e7fcba92bed561ce9c6b96a30c508c89a6a6665437","ssdeep":"","tlshash":"3980000e0282020f0022a8b08ae82c300a8a038008228e280008a0080e2b0828c000cc","first_seen":"2025-12-12T04:00:11.329317Z","last_seen":"2026-06-27T10:14:25.971626Z","times_seen":46,"resource_available":false,"data":null}},"time_used":782,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":782,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/osano-04c7756c5e710ac0e6e5296fe3c1a575401b1c1af795fc3d8fc2553f6841336c.css","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:46.846Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /osano-04c7756c5e710ac0e6e5296fe3c1a575401b1c1af795fc3d8fc2553f6841336c.css HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:46 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"693b5ef3-303\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4SWwEfomVL%2FwMt%2FHKwQAw3J2iN8ggA9MKQKrvr1WwT0WNUIEa61PPPkyqu5L2NTBloXKF9h3hXiW%2FgxmNSsUTM%2BzN0Fxu9cDkv8%3D\"}]}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9ba1e6889f74b512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":771,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (771), with no line terminators","md5":"dbdac8406269b796aa306a26e347725e","sha1":"1172b66bf3a47175b83311564213f23cc8b80734","sha256":"04c7756c5e710ac0e6e5296fe3c1a575401b1c1af795fc3d8fc2553f6841336c","sha512":"abdb27fd4c8b8ceac97b69c4542ec94dc9fafbae07d6eb52b4c772d3d4f24047c1fe5a6f38f156fea62dc8faeb67c4f592153363b0cc309f88bdb4dac08ea2bf","ssdeep":"","tlshash":"c60149b1d1c0310720b2056dd0d29f38e5bedbdbd5084eae7609557a84c43cd5c6322d","first_seen":"2025-04-19T11:58:33.765168Z","last_seen":"2026-01-07T07:57:18.752776Z","times_seen":12,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/request-5.47.1.min.js","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:46.872Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /request-5.47.1.min.js HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:46 GMT\r\ncontent-type: application/javascript\r\nvary: accept-encoding\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"693b5ef3-1d22f\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mDnKnZDiWYEq%2BQKb3%2FFaqjsNofnbKXkJphfF6LtZb6GTwRgZLDReDVCZFDetVpisIsQ4Qy%2FAXK0HQOib%2F25Ldv4Wbyw8Cvh%2Fybc%3D\"}]}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-ray: 9ba1e688af76b512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":119343,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"404ec3d511ebb2fd7a39ec0832d9c4dd","sha1":"95567ae7d91998353180b608c35e8fda253267ac","sha256":"d320f21ca2aaee3a37a53ffc37ea1c1cd7052489e81f5f36eb5acc5ddce0189b","sha512":"6bb2fbf72e9bb9616f8071642753aca9dbde2131ed4c82347a184ed3e995affa62dcb7998d5afbfc5379b962b826a3f38b00e17e8dcf3e57472060a6bd3127a7","ssdeep":"1536:O/EQy1h4rSbbjCdSfXiQ1rPAPBEoYTQXEU04Zxekn7ZemzCY3BYKtMzcJia/0zfq:+rcb2qiQFPjhUJNjtMzcJi9zeKTI9Qe","tlshash":"a3c350c6994b94d58e2521dec07bec08e0680963cdacf193ba2cded6745ef66c44723b","first_seen":"2026-01-07T07:57:16.704372Z","last_seen":"2026-01-07T07:57:18.745362Z","times_seen":2,"resource_available":true,"data":null}},"time_used":136,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":74,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/019aea7a-68fc-7b13-9ba7-706e6b8cdf32-1764962009-47817fd25248e61e53790a11adb21726f9614b9a.png","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:47.955Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /019aea7a-68fc-7b13-9ba7-706e6b8cdf32-1764962009-47817fd25248e61e53790a11adb21726f9614b9a.png HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:47 GMT\r\ncontent-type: image/png\r\ncontent-length: 240984\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=4,i=?0\r\netag: \"693b5ef3-3ad58\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YIp8jsGCaHBTirC7YFielRUHZDNK%2BeiHHep4xGf6xQ%2FuJcrToFMV6RGOicXHDgxALPUME4IfhlNpWd1rjgm7Mu7WYyn7PG%2BBEjY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9ba1e68faf98b512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":240984,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1440 x 810, 8-bit/color RGB, non-interlaced","md5":"1dda5883884ab1cf185d45658ac29440","sha1":"0b499df709dba6758811191d1604b35407266066","sha256":"f86b9f191cfbfee29d7602fbc5beaeab43123c07132373051c94f42eb7c85390","sha512":"367f58bf07892946b8c760408ada7665e41a5b189bd9757e34eb2ac693757b555c3a3d3f44d9ca11868ac99073ec8deb24dc22717a49ae9342f507fcab2e4fc9","ssdeep":"6144:j6FQSo3ztClYep+ntjxvT+y7RwzEu5CoePfTlZIPMLdV7:eFQSoDPNzRGteP7lZIPA","tlshash":"23341248d630df39e9810e3dcf696f4f50b6546469813934fb2236edea6ac54d280cbe","first_seen":"2025-12-10T12:23:34.698998Z","last_seen":"2026-01-07T07:57:18.750895Z","times_seen":4,"resource_available":false,"data":null}},"time_used":167,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":107,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/019aff09-6f6d-7f6c-af1c-c7a855482355-1765215399-3f5d477dd09be543f099a5df6df7df771c42afc3.png","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:46.880Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /019aff09-6f6d-7f6c-af1c-c7a855482355-1765215399-3f5d477dd09be543f099a5df6df7df771c42afc3.png HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:46 GMT\r\ncontent-type: image/png\r\ncontent-length: 770986\r\nlast-modified: Fri, 12 Dec 2025 00:16:51 GMT\r\npriority: u=4,i=?0\r\netag: \"693b5ef3-bc3aa\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dvhDVLsaMU%2BymPbFYrNUEGUF%2FbvgHE4Ahy9LxbiI38ZLCOPvsU1%2BzroETxQOiSWAf83RaNa8D%2F3g5zw01SQh4Nv2TdXDsX%2F%2B07E%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\ncf-ray: 9ba1e688bf7cb512-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":770986,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1600 x 801, 8-bit/color RGBA, non-interlaced","md5":"0a68575d8acee87ad937a31767e7df29","sha1":"bcd7232fe90f981ca1b8ceb8ad60436b2c21f31b","sha256":"8ed58021da785e245b1e2c0874eec4d4fae8e27e595788b28004f439ec155ae3","sha512":"dafe3f741e4448346a926a10896ce3364875638790a9b0601cba5a99236d822d0f6398ef75def2877a6a2cebb3e15487ae589c5bd19314862a2a46371c4098a3","ssdeep":"12288:ufNsI7XvYSnRFZL339oPBUee5zJpnqnWekRpFgR55qDZpbon3XHSQbANrut24a:RIbvYOZL90UeaSWe2gR3qZVonyQsi07","tlshash":"72f423796039d0638e9b1b30d4652fbf1ef703029abd902ac416368dda89f743669f47","first_seen":"2025-12-10T12:23:34.682659Z","last_seen":"2026-01-07T07:57:18.753958Z","times_seen":4,"resource_available":false,"data":null}},"time_used":382,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":323,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:46.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rainbows.run/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript\r\nexpires: Wed, 07 Jan 2026 08:44:46 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CeRG67haYkzKhPbgCo6FCwivszR0iu2HHKu5bPsOjp1oGFQg8mFrwRo%2Fhxr2rs6hkoDliQWClUWxjeymoVQyiy5w3WCraypPWyo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 07:56:46 GMT\r\ncf-ray: 9ba1e688cf7eb512-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-25T01:51:29.972722Z","times_seen":405441,"resource_available":true,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbows.run/cdn-cgi/challenge-platform/h/b/scripts/jsd/88d68f5d5ea3/main.js?","fqdn":"rainbows.run","domain":"rainbows.run","tld":"run"},"ip":{"addr":"172.67.155.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbows.run/","date":"2026-01-07T07:56:48.076Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbows.run","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 11 Dec 2025 22:55:37 GMT","end":"Wed, 11 Mar 2026 23:54:21 GMT"},"fingerprint":{"sha1":"73:E9:C1:F1:F3:66:13:30:41:9A:1B:1A:61:C2:9E:B2:6D:60:A9:B1","sha256":"9A:C8:9F:22:50:B0:B2:F7:54:3D:01:7E:B2:64:3C:A0:ED:64:04:DF:9A:9B:8D:70:67:7B:A0:7F:3E:6D:74:D8"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/88d68f5d5ea3/main.js? HTTP/1.1\r\nHost: rainbows.run\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 07 Jan 2026 07:56:48 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\npriority: u=3,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=BSSsjRFiZV06p9NDm6RLC%2F3%2BH3oTR4FhguRfSLFDrol7WjjZoKWnNPVE0gcXYq0puN%2BXxv9E4VNO6D3HBPp%2BN%2Fln6o95a4IOIV1Qm%2BZiSn0CvvA5Vu845bLPSukZJYQ%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public\r\nx-content-type-options: nosniff\r\ncf-ray: 9ba1e6907fa5b512-OSL\r\nserver: cloudflare\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: Accept-Encoding\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri, cfL4;desc=\"?proto=QUIC\u0026rtt=3953\u0026min_rtt=623\u0026rtt_var=4454\u0026sent=6217\u0026recv=172\u0026lost=28\u0026retrans=33\u0026sent_bytes=7294024\u0026recv_bytes=15111\u0026delivery_rate=54382307\u0026ipace=0\u0026icwnd=12000\u0026ss_exit_cwnd=86906\u0026ss_exit_bw=41086702\u0026ss_exit_reason=2\u0026cwnd=202270\u0026unsent_bytes=0\u0026cid=e1c4c3c3d1e2e40a\u0026ts=1716\u0026inflight_dur=737\u0026x=55\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10623,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (10623), with no line terminators","md5":"89031e0fca1fcf23bf3ae89487230bf5","sha1":"a2b26e0b3d866222f55b567862b05217410da31f","sha256":"dfa937999e14d98b514b436597c40521e09e1652f9b9deab05797e65e3d62ad1","sha512":"6af907a87f0b376e9401a00eb470d84f6fd3351acc8ef0dda7856052f68197b87b21a9984a12b8058572a5c4e66b6a0559c48445c92fd59b464879f93d1d617b","ssdeep":"192:BKcSzE8uwDrKyvu/YSxo7GpITlTpMfBJZZSDVkTjB:BKcP7wSym/9xoSpITtWJZZKkR","tlshash":"2b22c7e7f809655d0339c178142f6cc51138be819448a729d7689ceeb83a684e4affcf","first_seen":"2026-01-07T07:57:14.574409Z","last_seen":"2026-01-07T07:57:16.707396Z","times_seen":2,"resource_available":true,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"rainbows.run","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}