{"report_id":"3167ce3f-be22-434c-bfa2-a058ac9971f8","version":0,"status":"done","tags":[],"date":"2026-07-22T10:11:40Z","url":{"schema":"http","addr":"rainbett.fr","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"172.67.189.3","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"rainbett.fr/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"title":"Casino Rainbet en ligne France – Inscription rapide, gros bonus","dom":{"size":182507,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2926)","md5":"d3149bdc98c808a8deb00d55a270631b","sha1":"c25c2a2f09930909ab3e60dda954895cfcb36e48","sha256":"71d24e27fbb8912d86d87eddd9d89f8b92b7c5b0b5827f331441bd1033196f45","sha512":"339561031877d3bb8240ebbac06fa096aad0769013469095c5f8a23309bcb6bf955a5a1dbdf52adc03444df48e289bd858fb1b5dcf87dffa75f76081ee6f23a1","ssdeep":"3072:HoRLLw4GFotYqg3AR371N5LcKOEvjmizPbBVeQ1gT:HAQ4tX2ARr1vIKOqjvTbBVeagT","tlshash":"5904f5ad67f421a740c3c3c23f226b273ea5e697c6068608f2ed4b941fd2c68d95358d","dom_hash":"domhash3addebb2d80fb06348ef902cd7aad229","first_seen":"2026-07-22T10:11:44.526981Z","last_seen":"2026-07-22T10:11:44.526981Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rainbett.fr","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"172.67.189.3","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-26T10:11:40Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"rainbett.fr","ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-03-17","domain_rank":0,"first_seen":"2026-07-22T10:06:59.804578Z","last_seen":"2026-07-22T10:06:59.804578Z","alert_count":284,"request_count":142,"received_data":4373435,"sent_data":79757,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rainbett.fr/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"e4fec30b79ac0ff2f25b960248780445","sha1":"17788d1d89c67872c750e2dfc4e079084a58ab4e","sha256":"a9f37ed3f9f65ee752becd7e1e893ee0781753086bed12ddea3303a276431dc4","sha512":"442074629ff8cb9ef6ec742849d8e661387d194f6e74a0bb47e317f58557a09611fbb03659293c116f7327f55e57a2054f88c7860e15f3b1e2d31a429511adb3","ssdeep":"","tlshash":"6780000808030a22a03a228e28ca30830c02000833220aa0028fe008820e28e80e2c02","size":27,"data":"","first_seen":"2026-06-07T12:37:47.125616Z","last_seen":"2026-08-09T10:37:17.374897Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-12T21:53:45.193528Z","times_seen":418734,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/build/frontend/runtime.js","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"02e2fa878ad5ff0ec64aafc1deba788c","sha1":"2d33cf41828593bfe3b3c16b56b0336944549e26","sha256":"97a1575c74188c7ea756ad742df7f21f9d5c4d8ff6363f940c8ef0edd490efac","sha512":"10d01c41fffa766dd97a8f302b844d2ccb39bcbc3f21359026a2924e0aecb2a52f05e721c91afd312235492c26aba982995790478ee553d2a259e3ccfb614814","ssdeep":"","tlshash":"254196d722d8b4e663b84d4040ac8787f91e6536355de8a1eb91c9e1782c8b14ca7f34","size":2001,"data":"","first_seen":"2025-09-23T10:56:20.429759Z","last_seen":"2026-08-09T10:37:17.295316Z","times_seen":139,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/build/frontend/app.js","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"614439f93859eb949774da21bb3b324c","sha1":"96fa5d909ba3a1c7bc55dce813707ff4ceadc68c","sha256":"8de78a081a5fbe1aea6edb6e4f26bf6d36e670a219ac50fb65723c02fa0c7065","sha512":"f05df3dce5b6a9b7c81d1d84035f31289ca915264cfe8effe1b68f2ca0f71fca11bc24aef62957c391002d470d744a1ff55cd5215a1058e98209e7e68a61bb03","ssdeep":"768:toC6iojJ7dLfn7aJBVawnwxw8H9bBws7blPaNdfPtnaaSReFA78iCKkKhHzLzan3:iiiB7NBhvCfPk978akWM78QOJ7mPbB","tlshash":"cd43c75cb38075324597a232425f920ab2767455208ac4ecb53ac8e5bef8c9d7273fbd","size":58586,"data":"","first_seen":"2026-02-02T10:45:14.569249Z","last_seen":"2026-08-07T10:24:40.801487Z","times_seen":26,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"map[type:null]","filename":"https://rainbett.fr/build/frontend/app.js","line_number":2,"column_number":54895},{"level":"log","text":"fr-FR","filename":"https://rainbett.fr/build/frontend/app.js","line_number":2,"column_number":11829},{"level":"log","text":"fr-FR","filename":"https://rainbett.fr/build/frontend/app.js","line_number":2,"column_number":11829},{"level":"log","text":"fr-FR","filename":"https://rainbett.fr/build/frontend/app.js","line_number":2,"column_number":11829}]},"http":[{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/break-da-bank-again.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.402Z","timestamp":1784715085402,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/break-da-bank-again.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/break-da-bank-again.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\netag: \"dhcvecrzjn4nro3\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FZX9hNYPLQhVqmQ8j%2Fg3Yvgd4i3aYJAJEtJ1OuO2dUznB%2FyBUTE0eBmfhapzbZiW06fOX7lF9N2ZRNnqdxbh4r98BLWh9R8PwgtToZPrWAS9%2FRhhOzwSSqU8oya8Sg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a943bef8b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":35859,"size_decoded":36871,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 364x265, components 3","md5":"d80fe1f86cd827957174f961ae6815cc","sha1":"c626cf37ca1f8399df7d843caeb3c00338ef4281","sha256":"e4f2aa7a6ae12fff5a8e7923c389fce4c826a0f80336b21b753723f7e5df4251","sha512":"3f71f619039bb3672acbfc191e174ab845ce8155737482ce1274b6c8ca44d9cfd13efb422f7108b6e8b631fd7f4e2d5a40435cb1a5b745fdf15a47c509163aa6","ssdeep":"768:zXFir1roYeWx535x1H9dyK+e3QWdnEApiSUL4kPQeWth:LFiJVr337R7Q6noQDn","tlshash":"a7f2f2ff6be95918719f369eb0fc214cfca83ddb617b0216256747487b29390a3a0c48","first_seen":"2026-02-01T16:54:15.932721Z","last_seen":"2026-07-22T10:11:44.528293Z","times_seen":5,"resource_available":false,"data":null}},"time_used":497,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":425,"receive":72,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/dragons-fortune.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.814Z","timestamp":1784715070814,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/dragons-fortune.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/dragons-fortune.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvectn2wyoidm\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=j2hJAWBV9Yg%2FPVdMkeJD7M6tVXwU4YD50ogepiBn%2BDm9ZY0qeyLVX1UcvnBTF6iHJfuPzUTiOWd8jKrmsS2RDeYq2qPTqgZg4V6egV9TYmKfkw1WKLIh4Fb1RYw4Qg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e89be7b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23818,"size_decoded":24831,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"00f0a0986aeebdcb879638a3a4085d73","sha1":"a6e1e1a182ef9a8382987839f7f0856ad2516fd8","sha256":"60531dd0c2ffdf9062e9b4f0124c7859be81dcb9f444ec4de2865e246a7dd9b8","sha512":"5d413c3716a84d8d38ad42410b1306d3ef8b7ee1e6a220f7c5077236bd599e9bc16d7337efc181ab026b3849d0ca40f1648600ce8fcea5a7b265271ba5cd703b","ssdeep":"384:eZVvZqeeoc2GM29Nb6nLncy60axTryz8zKJ/sqc/7P0:KZVc2G19NmLnb6LxfyzVIc","tlshash":"cbb2d19f3e29ac15fbbd46317e3c00ceb639b8ac2f6949c614608b2d9f704d249d4093","first_seen":"2026-07-22T10:07:06.186667Z","last_seen":"2026-07-22T10:11:44.528956Z","times_seen":2,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-17.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.858Z","timestamp":1784715070858,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-17.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-17.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehk1ls5y2dl-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zSoeWGVwSw%2FmHf8wN2GHHFzlNGLAdpiuFxT8WjE%2BHB5irCDgmNAwRsdWWRlhhOS46qptv3EKLHzoFaRrTg1xOUYDv1VKJ0xswdncvzNXD7qhrBX3WHtrM6ozraUrpw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8dc12b4f7-OSL\r\ncontent-length: 1356\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3081,"size_decoded":2380,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"95a2291bc6bfb22a5f5c638257eb08e3","sha1":"6c615add4351ebda719a8921502723751431c469","sha256":"e29394ad1cf34b556b6de5c10afd62964807d19e0494cb8137dadc003f333911","sha512":"72fc5b010c871b0b68bd640ffca2f92bf6d1bbad3d77b772bf661c4d94413c703f060f43eed2b288e18dffaa22bf198196846dba9dd880f975d4d42461aa957c","ssdeep":"","tlshash":"e95166f263da62d1a90feb81a4169833be5e3cbb3b5ad74dc1b0e744b652154c44ccd0","first_seen":"2025-09-23T10:56:20.373094Z","last_seen":"2026-08-09T10:37:17.36913Z","times_seen":81,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/extra-juicy.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.404Z","timestamp":1784715078404,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/extra-juicy.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/extra-juicy.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\netag: \"dhcvecukf5cmkkd\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gI14yM9vaFkYIPNTB1xhQOHPe63eGzcApgbeU2dajuaVIcsxmVszMKSpeURPceH34bQo7XyyYwo17k8eLlpY0z8bwLf8aIYoa7uVdNuW94kQAqndTHC9qDUgIfOgcg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a9180d44b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26653,"size_decoded":27649,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"ea38b5ec0fd4f5d148babd23b92908f7","sha1":"4e9d643f18a7aa9e4adbe807069e880bd346ed5d","sha256":"22ba6a5d84c4a868ae3c084f25e9e368b1c57074d0f325b068dcafe253a74b17","sha512":"6e28569f4af99786247f183fd571c465977228ff592354fecfae8775f82cceb7c5959c88cd5f83878db070d33e987a7ac3a2408c6fe0758abde582f8a8de65fe","ssdeep":"768:UAwXAyEnl7XtAnndS+EdRyhfjkcWHs6hnDTx:UDwxztAnn3myhfjkceVhp","tlshash":"b3c2e1dee7245425213dd95ce50916b80cb2e38cf8b6949373e9dd88ea52382b121b3c","first_seen":"2026-07-22T10:11:44.530413Z","last_seen":"2026-07-22T10:11:44.530413Z","times_seen":1,"resource_available":false,"data":null}},"time_used":172,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":152,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/a-dark-matter.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.406Z","timestamp":1784715085406,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/a-dark-matter.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/a-dark-matter.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\netag: \"dhcvecqgrtx7cn9\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ArbMiDJ0xifC0LfAWisj4jE%2Fl3Hu4349D2RvypmM8Mwcclfj%2BM9ZpaGCsnP%2FoQSQClxLcjM6S%2B%2BLfhutUyPkQf4K6UGcDmXWahBbtIZht5FmjPFV68gmRysyUHh48Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a943cefbb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16389,"size_decoded":17397,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"b2a79227372fc1a3b29dbdfb2e290230","sha1":"162573244b91faedfdaf04604b3190541eab3152","sha256":"35b623677986f53d60f9499b826ec2c07288c4d5a589b8766c4a88143b65c069","sha512":"f537f0c07073e7a457a2d23515856a3939fb103923d6abf4a31a41b6c691f47cdf6076a91669edf53ae3ba353e00ecedb2012c38bb14ad6f0a0c587699b8b0cf","ssdeep":"384:nmsYf4oVGTQNJn9LelhynbCbeOrQevvTMSE/:nh0438nbuHrPnTz2","tlshash":"e872cfc6522a9777e51a4be20bb1e3335777dc85d5a09f8e84397432b3cee401eb4a12","first_seen":"2026-07-22T10:05:30.64812Z","last_seen":"2026-07-22T10:11:44.540245Z","times_seen":3,"resource_available":false,"data":null}},"time_used":391,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":374,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-13.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.853Z","timestamp":1784715070853,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-13.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-13.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehjkxnyzf1-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LCWwzhlDIABXn6jt7XpkqNEaI6yvCRAm0xTO9DV3OX%2FxAZgirFtQ%2F7mg%2FAr9hhed8ZJ%2FVUGbrq3OnFQrTvOkHcj8DM8cvhC7KSRJZr1veabj%2BAl85KdjBafHSg62dA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8cc0eb4f7-OSL\r\ncontent-length: 314\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":541,"size_decoded":1342,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c03da396c4a54d198a2aea69262fc761","sha1":"91f908651645b656a6975c115bb6e74b367c67e6","sha256":"aeea11511c54fc4e4d8b68b7ba799d2540a4aadf919ede1733d0634cbbd5dbb1","sha512":"0f6c0c61fc73f4e07a276f8413c82b061ac07096e4b92cd2293fd3cd6b4e387cf213bcf713d0b6302817408d13f5cab1e956e66c2b77e41e81552517aadd19df","ssdeep":"","tlshash":"34f005e5f6ccb0524605c712f52ba533b87f74d72abdd54a90a12750f5444cec81d9d8","first_seen":"2025-09-23T10:56:20.452417Z","last_seen":"2026-08-09T10:37:17.248502Z","times_seen":81,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/roulette.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.824Z","timestamp":1784715070824,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/roulette.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/roulette.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecpeo4wp5fk\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dPsCntBxyfJvMPwb0UWjPz56U3I%2BE3%2BbC1%2BMFIVwOAhngTkxH%2Bsm4m%2B21ne9hr4F6iR8G%2B0ngEjlsDHUg7pD3HpFVH2VAAaaKjmqRrIY8w3j4F2KD1uvZQpkkeRmaQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e8abf0b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7040,"size_decoded":8056,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"cc834f0ad2a327bcd2b52345f6e938f4","sha1":"4c129bb7a1cf92bc84c246eaccc6a732413b575d","sha256":"cbb37f72399881942f82297e55732dbff0c779b2f875cec38e677b6db87c0b05","sha512":"3035e79a5c0d54fbf6942a5c3c4a8af6af4c80f7a9c8baea81ab6eb1bf77aeeda357e5075aab546dd952323f264f70701d93a652b8c002e302641eaf2c2f93fa","ssdeep":"192:+8We9N6bfPehBg9CFGaxNExgL8DEQH0eQegK9aweBTf:oe9N6bf2hSGxNhADEnZxdf","tlshash":"90e1ad0fa1bef002e15cb5b225cb47a67b907ee02af00aa7524a8f91bf9e0d44c5c040","first_seen":"2026-06-11T03:08:59.249984Z","last_seen":"2026-07-22T10:11:44.541866Z","times_seen":3,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/18.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.870Z","timestamp":1784715070870,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/18.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/18.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehipz5wc2u3-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JEEW0HRl5HJ%2FaDHWKHSl8L69YbXftbGRcpIXAocBTR5lzj4iBHIY%2F1GTZRw9cz1uRpedeUiUC20prE1fLxBitORO1ZbeZa%2Fj%2BnRibSItXejX%2BbJeTHXnbxMfJyD2NA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8ec1bb4f7-OSL\r\ncontent-length: 1225\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3675,"size_decoded":2238,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"71ace1fcfb0d140bb221f1bc54968527","sha1":"0bd6be64e7dd38faa2dd1234b76065d6cc80609a","sha256":"c01ba57e02b7ee032930c7756ad3af600b34c6b06bf2edba619f0cb41810c906","sha512":"665c083447e8b2361d2c90e79e9211d9a8ad4b3539c15a7121ca9a17edc48b613feb246c99ca70798ec341c473cad29bd2b2342a982a5de3152a5e7f45f0bd32","ssdeep":"","tlshash":"3471f2f983d4e2d4d514e7f4d536c2e6396324bb3a15cf5c02e55ea8bb1242e954ccc2","first_seen":"2025-09-23T10:56:20.428584Z","last_seen":"2026-08-09T10:37:17.325957Z","times_seen":92,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/golden-colts.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.414Z","timestamp":1784715078414,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/golden-colts.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/golden-colts.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\netag: \"dhcvecwf3m4glzy\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LtU8F6YgHNqerw2%2FGIsAjo5vsVv8%2F3liGxOkfwS56KB65PdVstbKP9t0sRLtB3MNiSQQj9dzkou5mdxouNkQWBzKhBxmRYhSv7QguVOVST9Z2mQvqiqe4FkFZFCHYg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a9181d4bb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28510,"size_decoded":29511,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"d712cc526651a410b0980b20c472f8c5","sha1":"a41995ed761562479d0defdf5d3df2052bde9801","sha256":"e3c5c877cbccdc686210e7547268693bf2275b466faeb9a2a78ea08323a841ed","sha512":"00926366686321fe1f21771555517da56ba844661dc9a8d7aa06066fb76f70777ccd16c8af3b255f6107f0cc47121dababf5739492b611f635b0da692d696b19","ssdeep":"384:goDKBo3ALYXveSPjdlD7Yf9h4/zt9K1c0ugdnJ/cSGLkI9Iyqh6/rEB830aK73Wc:DD4o3v3b4U/zt9cu2/cRCII23BO","tlshash":"f1d2f14b3b11d952da7c291bc80408ee3f79761aaf1f948e9af74038a3729c19db0d55","first_seen":"2026-06-14T01:02:41.530658Z","last_seen":"2026-07-22T10:36:34.494782Z","times_seen":5,"resource_available":false,"data":null}},"time_used":456,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":396,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/ajax/winner/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.014Z","timestamp":1784715085014,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"POST /ajax/winner/ HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: fr-FR\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 85\r\nOrigin: https://rainbett.fr\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":85,"data":"{\"exclude\":[\"617\",\"804\",\"806\",\"384\",\"914\",\"481\",\"171\",\"218\",\"639\",\"931\",\"875\",\"676\"]}"}},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, must-revalidate, private\r\ncache-status: Souin; fwd=bypass; detail=UNSUPPORTED-METHOD\r\ncontent-encoding: br\r\ncontent-type: application/json\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\nexpires: Wed, 22 Jul 2026 10:11:25 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RpU55%2BqJAUpx4uiqWlQTT8SA8IFVyQHk%2BfgxhngJddkMp%2FB23FPo14nN7e8L%2FKg%2Bbv3KfcBaWZuoipUuYGGJGPSfz4nKDF7iNuwKwOplFr90j%2BGi2SMOK6EqS5FQ6Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a9415edbb4f7-OSL\r\ncontent-length: 233\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":599,"size_decoded":1218,"mime_type":"application/json","magic":"JSON text data","md5":"f72734274f434395686610e359aa2336","sha1":"a81b030ac088fe2890f51df45bec18a2ca5166a0","sha256":"2a1d683bfa43321871938a6d658c32ced84575713f1ba2fbf0a6cc67b52a612b","sha512":"ed88316bf4f0ba57794807ddbf874ff0f6273b357058d5b1ccd27b572513c3df842250a1ec0723903fe33659278d47fd7297458a6d9a7e0c47707aa9ea244b8d","ssdeep":"","tlshash":"54f05e52aa21a73fa18350d4ecbbefce1444e863542d4834fcbf19a2c3225211fe970c","first_seen":"2026-07-22T10:11:44.543763Z","last_seen":"2026-07-22T10:11:44.543763Z","times_seen":1,"resource_available":false,"data":null}},"time_used":366,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":366,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/achilles.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.441Z","timestamp":1784715092441,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/achilles.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/achilles.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\netag: \"dhcvecqgrtx7ysu\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 299\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=liwsvt1MrYv9WjJakagXtzBK8d4kpBUWr4QYmv6F%2FEzH2Zboec04X6hZIJsytViaUGsBUadwZv4J%2BlBpUs1JHPrJ7Lrj4fBZUfg0dK0IVgJ5YiIRZCnYPtyQQExTpQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a96fb85bb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45102,"size_decoded":46108,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"ef7906a7b4ff8c970a93cd0bf573e6cc","sha1":"05ba1f173caa5ecdd705ea0e59fa51b3b8ffdf66","sha256":"7486b1a9a3dd65019163c682fd7f8b2561ccf69488084d0cd46cf560817a628a","sha512":"822d803b23c81e0b3ac8c104b56e1e849c81dc1b68fc5f2cc8fc416e1819c22eee296f3a71b50ce474b92b36a2576b5b4fcc117e1c14e48ff4f3664ba25b2163","ssdeep":"768:gpsuyniW2aZIAeFiwYdU8mmggTUkFssqDHBV50UNfeqOA+5RjON1AkgWaD6UZjpU:OyniDa6A5wRDkaFBV5ne5RjOLHIoVz","tlshash":"5c13e13345987b71bc3f7a52865ddaf2fe1b71e4324ca5009d78aa41bf09c707289b98","first_seen":"2026-07-22T10:07:06.31269Z","last_seen":"2026-07-22T10:11:44.544845Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/day-hawk.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.827Z","timestamp":1784715070827,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/day-hawk.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/day-hawk.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecnya20i5so\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:41 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kP8KrWy1A1qGOFf%2BaE7%2BAgq%2FOkQcI5y4v80Z%2BOJrBotb8e1hIVAyyuybk4sNRPwBHYe3NE5eGx8W2xDKz9xcUj2ij15EwQNQukQBLV2KtOIFGVwVLh58FAxeVY9row%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e8abf4b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7512,"size_decoded":8524,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"c9169aaa0adf138f37b3513d0e899530","sha1":"03a5b274a9281122cda09c21c08216bb621a98c3","sha256":"0fcfce6950719e543bc16e11a4ccc495ef3bb375d1cf7be55fa302d340d63a3c","sha512":"7633abcfd07072e22a602405f31f2920bbaf49dba7ec3ded98de025becad2ed26ded5c2f82bd2a972152d4d2e5bf47214b1d7fe463c9175ae5e3a6337a914a3a","ssdeep":"192:9pZcDcuz8K0GzttRHNA2TtpKDk674e5s4C:9pZADz8IzlNJfKLkea4C","tlshash":"acf17f8b373ba574febc007bad064f5afb54e78023649e57a5d19f0427192e72c10971","first_seen":"2026-07-22T10:07:06.271714Z","last_seen":"2026-07-30T12:09:04.797525Z","times_seen":3,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/ajax/game/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:16.964Z","timestamp":1784715076964,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"POST /ajax/game/ HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 114\r\nOrigin: https://rainbett.fr\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":114,"data":"{\"exclude\":[\"2203\",\"1878\",\"2004\",\"731\",\"852\",\"1395\",\"718\",\"1424\",\"751\",\"2084\",\"1434\",\"1551\",\"2180\",\"2446\",\"1033\"]}"}},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, must-revalidate, private\r\ncache-status: Souin; fwd=bypass; detail=UNSUPPORTED-METHOD\r\ncontent-type: application/json\r\ndate: Wed, 22 Jul 2026 10:11:17 GMT\r\nexpires: Wed, 22 Jul 2026 10:11:17 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WkuO9zfDvhUJ7V4dCeZR7xPqvQZ1irPIlpgkEJIUfpJOMlzW5TNv3UXVla%2BD7lY3CzOlKeUU1cZdYbuI%2BM%2F1lPR%2BXNsjs9oAShGq58x7LJKcOXEbN15usZVj5eNLgg%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a90f0d12b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":92,"size_decoded":1031,"mime_type":"application/json","magic":"JSON text data","md5":"766b2555a39e415af7a4ae1d4ce6b157","sha1":"8307a981068cbb70c451903212bc005514995543","sha256":"f2ba2ba324bd2002c62af29ba0d9844140dcd220508f37dba05ae820024621b7","sha512":"83c76d7a45636406ced22a97791df12502874d4d070a181823d489dea74cdd6dcb89d4fbcfea2b31c6a2dfa5c64a00dbc5b8aac1a53631c5ee44e4bf094ae70c","ssdeep":"","tlshash":"55b012cd84d0040bc52301147c87329d21ab0dc3907044001a4cd94358d41250103c11","first_seen":"2026-07-22T10:11:44.546599Z","last_seen":"2026-07-22T10:11:44.546599Z","times_seen":1,"resource_available":false,"data":null}},"time_used":334,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/ajax/game/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:22.961Z","timestamp":1784715082961,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"POST /ajax/game/ HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 114\r\nOrigin: https://rainbett.fr\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":114,"data":"{\"exclude\":[\"2203\",\"1878\",\"2004\",\"731\",\"852\",\"1395\",\"718\",\"1424\",\"751\",\"2084\",\"1434\",\"1551\",\"2180\",\"2446\",\"1033\"]}"}},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, must-revalidate, private\r\ncache-status: Souin; fwd=bypass; detail=UNSUPPORTED-METHOD\r\ncontent-type: application/json\r\ndate: Wed, 22 Jul 2026 10:11:23 GMT\r\nexpires: Wed, 22 Jul 2026 10:11:23 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WvAEQ%2BMPm%2B%2FP%2FSSmRn7SFYg3%2FFq9ITosOt3Qdj%2B1hvZWSapVttcsfy8Lbzbb0bD1uLbFLEKJQW9%2Bk3rZjirz18iQp73PwNuPtNyAZA2FyrdKwWZSn4WujBhRxrwCzA%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a9347e7ab4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":86,"size_decoded":1038,"mime_type":"application/json","magic":"JSON text data","md5":"b9aeaa4ee15cbb2810676a307878522a","sha1":"b931d806883e2eecc3bbdaff310c5793997761df","sha256":"5ba8dde01dd35b5d9508ac74025350ccca6197989889e2f956cbed4623e65bd6","sha512":"4d5a9de6b8abfd935aa34e601e3f3ab0b4e3f586a41e0eb0b19aa9aa7e213472cee90b846626fb787900b8312b4cbd1904c4c282697c0ccffa8bb784e3668de4","ssdeep":"","tlshash":"bca012a5a518054901a316400c8730a822104b1701944530d287884044140020013c50","first_seen":"2026-07-22T10:11:44.547675Z","last_seen":"2026-07-22T10:11:44.547675Z","times_seen":1,"resource_available":false,"data":null}},"time_used":317,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":317,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/arrow_right_icon_v2.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.797Z","timestamp":1784715070797,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/arrow_right_icon_v2.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\npriority: u=5,i\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/arrow_right_icon_v2.svg\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9ZNNYnzcUZ%2Buc8Y8CAXmbPodRfiRV7mZUphEBiyYsXwpMuOTx1iygK8PI0J6907DMKyKQGc6b3J6N4yR5QKShBVOieekDu4YdjreEkWEpKPgrDFB%2FBa0GwAI4WLF4Q%3D%3D\"}]}\r\nage: 292\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"dhcvehix4cu69v\"\r\ncf-ray: a1f1a8e87bdbb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":355,"size_decoded":1174,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8716201a632adef0156bf6d3f2fbe369","sha1":"4b88b95b91c6597908d5da128283ac4c99544cb2","sha256":"6fe8a1b7dfa91db87484fe8b87176374df446f3c337ddee4ab6418fc9ccbb69b","sha512":"077a28d2180d098fecebed83e2437b28f7ceebf4bb302f0d1765c979b53c314e2e6d3364080fc249c61b9d1c2eac86bed248d14597c8c2b91facd5e49e5338d8","ssdeep":"","tlshash":"d2e0209513084c3db1320710f7587338356a518345483544d9311d31350495e7d3f5d9","first_seen":"2025-09-23T10:56:20.268091Z","last_seen":"2026-08-09T10:37:17.254597Z","times_seen":62,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/jewels-of-india.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.810Z","timestamp":1784715070810,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/jewels-of-india.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/jewels-of-india.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecxetktoqc4\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GM5unsnEfLlwdqn%2BQ6IfYWWbqzFKI7JQI9PkJ5mT38oNOrB6nqFyenXEVCh3OSpeKqPeP4YCRk%2BDiVlSgK22VNNU6M3lpWuTlBVfWn%2FKF7X%2FhDlRWjHzbGmCuoxdPg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e88be6b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34132,"size_decoded":35149,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"ff88d268441f2718ebe3d790e981ab72","sha1":"77bf3a79a243899eb7d9bfdfe1dc57919f263093","sha256":"491e4aa1daa98b43b034c938a0e6a437164dda259446b067c37eedac8448b209","sha512":"32e1b97d696681e7aaf9c1ac2351646c345246143adacb5c393c51d68532d7e2698e8baea92bc6f9b5f7967781a2732fc1136344e410c548ff34d999e4b9d90a","ssdeep":"768:T+Ha/tC9Rj/jpHVLRtWkuvwJTvqcjYANiVJKNS:T+wC9RF0D4TqcjYK+","tlshash":"b3e2f1a539884592613fa35a2e8d1335f0484e53afe81e7cfa35809bb757a8500ed1df","first_seen":"2026-07-08T14:48:57.70372Z","last_seen":"2026-07-22T10:11:44.549217Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/monster-mash-cash.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.399Z","timestamp":1784715078399,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/monster-mash-cash.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/monster-mash-cash.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\netag: \"dhcvecyjb05gouv\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BespdS2cX7Zk4BHCYGTRDGlDjEseh6paNLv029e7%2FjNPyA3Pdik0C7fLH7eprRHMUV8vaN%2Bg%2FDj%2F9KVK%2FqBSOzm59n4Tx%2Bhs1T8RxNnNzzIpK5c%2FBc%2FG2hp1W7zjZw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a917fd40b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32215,"size_decoded":33233,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"60b5e28b2d1bd0803a4ba3d28f371da0","sha1":"d3173b55802ef54814ddf2221ff38fd4c344fdc9","sha256":"533676cbfeb6aa0b09744b23873f528e1baa8a052ee7995728be353b43e22a5d","sha512":"0d271430b09c33db39be20d5e7f32b243c790dd74dd424de3a0a38c67bc4fc1344598c7a8bf2014277c7bfc7df35cb0b8dd2f6def59045c108e7e336350e8cdf","ssdeep":"384:UV35xn2IVTDtfB/HdpgJ5z3+OOR7bwMufPxbqhYrD9Mn7HzydzzD1vsJ8e96gY93:qJxVXtfB/szz3tf8huy7HWqJ7GD8Sso","tlshash":"a5e2f2958f5194e07cec9ebfabde7699268a48fac3486c1405f790691f1b34aec0850f","first_seen":"2025-10-14T14:51:48.839896Z","last_seen":"2026-07-28T16:34:56.651055Z","times_seen":6,"resource_available":false,"data":null}},"time_used":437,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":368,"receive":69,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/divine-forest.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:24.286Z","timestamp":1784715084286,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/divine-forest.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/divine-forest.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:24 GMT\r\netag: \"dhcvectb69e9n6y\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dBdpHm8ERkVtLvBAfY45DShX7sLKrkDeOflzH%2FnJ1u9WTq8QSpP3DHoLl7PZ7lXwG0asXwd%2BwxzMY0Xzo8HzBjcjOXQH8LI9a8t1bhTaQryKQ7bepwjDRk07A6UyTg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a93cceb6b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":30058,"size_decoded":31060,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"b8084cddf8a4ef5624a8ed764fe882b3","sha1":"3ba91c2c6ca91096064105134a25e9ed3a22e90b","sha256":"c88bc15a949c15f79512860c5035dd2134c3375490eb47ae50d7ec29820ec4cb","sha512":"563b8326e72ef1d2ca48174c5f0dfb6c1e3a056e11f687c8d49e0dad71515846228b07b7370284abdcef9e91d011b40c763e1bff423be04f63141aa04309a8e6","ssdeep":"768:rC9PaH3KnAnUlObtVJKfCkBlMYbSMGkkZ:GIXVnUlMVKfCkBlrSRZ","tlshash":"44d2f1b38dbb1ab7d9ee476c8b4b4eb17dc169acb7241b8bbc15c8274b2e0502358445","first_seen":"2026-01-02T03:19:50.927518Z","last_seen":"2026-07-22T10:11:44.550336Z","times_seen":4,"resource_available":false,"data":null}},"time_used":405,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":344,"receive":61,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/2026/03/baner-2-69c5655c95edd2.15449470.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.794Z","timestamp":1784715070794,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/2026/03/baner-2-69c5655c95edd2.15449470.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/2026/03/baner-2-69c5655c95edd2.15449470.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcxh7h3r01sd7db\"\r\nlast-modified: Thu, 26 Mar 2026 18:33:28 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4hveWjCCaQ6fRS1gjfCDcpx6GtJYB8ZkVrXm7Q%2B02JGdn5%2BrQY%2B%2FwnL65XOdzuFQZXHm7m9x932UOPjHQP4oaOD6r3u9a%2BpSO%2B5%2FF6R%2BqlFpNGcNEZYQbZBY8Fe0rw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e87bd9b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":616079,"size_decoded":612778,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x680, components 3","md5":"80659f6aa40366ef8f580be0d47646b8","sha1":"8527e561f7a518f1610356f4054e70d0f42921d3","sha256":"c9ed52a7a6dcf59d2f267932b514f42f7f1f4bdc703f7f4985014afdcfab67aa","sha512":"009a248a1d38cd5a105f5761dc4fb131022cd476bca6f894633feacf3c7ecd203899ec01812f830cf297381c733d6d66592145dc7d1c19e2cf648a42ab3fefdf","ssdeep":"12288:wMSi320hE3ARbueA4/UxnmLa6v9/xkWM34Mcln37kCPHv:wM932KEQYn4rP6oh3ICvv","tlshash":"84d423ddfe5ba74a8d8d0252eb53ebfe059233bdb04199c60c58cf22a95691748038fd","first_seen":"2026-07-22T10:07:06.206152Z","last_seen":"2026-07-22T10:11:44.551585Z","times_seen":2,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/mohamed.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.825Z","timestamp":1784715070825,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/mohamed.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/mohamed.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecovmaeg2vg\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w6kmZT5cYkdSoKj2xSQflpW2jhzSQ4FiJqoS%2BA%2FQHgPnepM%2FGlJ2bh38BUUiavhtx73dNWjhQnLMShZFVstHYCCbGi4qyyeaX4STkcfjOviuePLD%2BiR8U0SBdLo%2Ffw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8abf2b4f7-OSL\r\ncontent-length: 3700\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3724,"size_decoded":4732,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"c78230ef16850520034078383263d44d","sha1":"ec4376ce070ca17f882542348fed927677731ff2","sha256":"4520829b80a1166d530e3b3c44efea727305415ac56efd8379b2af5c67ce0f82","sha512":"48e215016ab7718fcaab7a9a5b56c1c3c9536d1df731f1555f3186ee03a22cf2235db74af7472a38f04b77eac789f4d065100d6e6d77ef5cd87c7c73fe8d50dc","ssdeep":"","tlshash":"7b712a8a1f978c06ecff833ae64f47c6b204dde94a4e4727118597aa331d0e869522e0","first_seen":"2025-10-09T01:23:42.797662Z","last_seen":"2026-07-22T10:11:44.552258Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-2.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.841Z","timestamp":1784715070841,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-2.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-2.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehk1ls5y164-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1oByVcn%2BOZ18gqF6snMQJlsGbDi9IGmzcDcPVdNnBfrxbMJQ3oEDqFeZoic3MfDJMyOtO2H9Z5a74qTxJrhzxzAA5mDnf5iZ5mDcqIS5G3%2FjWYGOvT8nR6wQMn2M0Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8bc01b4f7-OSL\r\ncontent-length: 775\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1516,"size_decoded":1797,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"53eca9a29b8da20d28484c8d01e514e8","sha1":"1f1d6484552d99f175d7041fcf7976e1efa933d5","sha256":"e17ee8d46394ea794efaba9a0f57838f089e8de8f7a644e88fbd8884c901e1a7","sha512":"f55ab27f3394237f313f627c7f15026fffde59d29090b0efc32fca2bd5d791ecc22c921e1a84edaa24c9556bd3ed13e230c6cc2e5baa85bd515933cc5b0d85a1","ssdeep":"","tlshash":"273167ff03cc72e0f402dfe1d81578667ea638bf6e15d75e8255b920b51126f0588884","first_seen":"2025-09-23T10:56:20.511844Z","last_seen":"2026-08-09T10:37:17.216876Z","times_seen":81,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/the-ruby.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.405Z","timestamp":1784715078405,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/the-ruby.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/the-ruby.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\netag: \"dhcved1dpfmjmgj\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fgGe7i8vv8IKvPRkSzPlQ0XV8lIjyaDJNCZjEd%2FHzZDyLndEUeKz0K09Enlw%2FUkAvT%2FCm6A7%2Fra%2Bugh9igtNNLAIXvwMJlixY9vvI9Aj6Nvh2aNCOsrw63uC%2FJyb3A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a9180d45b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29107,"size_decoded":30112,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"27b8cf721872db40926a65be99d7ee2c","sha1":"038a87c6fe538efc6e7a0034159ca48ab42f80b3","sha256":"634ccca5d01e3bbdd88390cf5d196c9cfc7d1800ad63e4ec3afaf56c2622aa2f","sha512":"e72c0a9de6da7131b8fce9bfce191f888f0b0c26fe3d9f10337d90d773d2b73a51eaa072a4c4f7a6fead4c53e391027cdf6d5d6e131c0d09ec1e2e570284eff0","ssdeep":"768:/ED7wD6vTz7xTVMnFle/uSD3C7BBmlkUj2bq:/ED7w2z7xToFcWGS7Bw2U6e","tlshash":"20d2d1d88b57a8ede0f89efe0fc253555bb010e6f39946113be60745272d4d9a1bc007","first_seen":"2026-06-13T21:57:34.789867Z","last_seen":"2026-07-22T10:11:44.553503Z","times_seen":4,"resource_available":false,"data":null}},"time_used":428,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":363,"receive":65,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/black-gold.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:21.288Z","timestamp":1784715081288,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/black-gold.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/black-gold.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:21 GMT\r\netag: \"dhcvecrghsmepv9\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cEzfw%2BNAU0s6z09%2B92j4MYRVmfBtke%2FuSDhNX%2FZkVSh0pfYFD9Cy11Uy3V9IIJvMdkx1zeD9QNM7vhYqgGCblldrCICVCLHF82IqE6yWo%2BWKE5NCMCZ24kbJc7Vllg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a92a0df3b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":33525,"size_decoded":34530,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"102ef68b232b983a0dddeb06cd7581ec","sha1":"9b82ea11d08523b4292a72e6ebce99d0e6a6ac0f","sha256":"ef5c39d2eb58d995e743bd4bd223fee0119ca9a69f3d5289b0462fcd768eabbf","sha512":"3591352c57b3df1cbca579be4595d68700c6b40312a4ea5ff06e4127fb30ffc4207656c8ece070cd3b856bc392a1a2b74ed5fa4d5a86014807a940b7476f5784","ssdeep":"768:gHAl3QP3GM5sqU+JReVSIXExdn6UGBCc5Qd0S5PGNNX:ggpQP3G+lQSIXExA/4WQYNNX","tlshash":"1fe2f109c19ccadc128f2e362801309d6634ad18bca8472dad857dda9fb5fb4de9075e","first_seen":"2025-10-26T01:21:03.267717Z","last_seen":"2026-08-07T10:24:40.889421Z","times_seen":4,"resource_available":false,"data":null}},"time_used":214,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":190,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/interestingperson.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.829Z","timestamp":1784715070829,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/interestingperson.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/interestingperson.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecohbwis447\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FFiwPO2f6oVLlnSYbMocB0nvm1Z%2FZRAbbaV1c0DP6KDVK8mtypkfEqseOz0KKI2CQbRvh5aGve%2BQaG71vepEX9e5s2zCKViQZEp0rW8abQvo%2BFYvBM1QVU26q02Lzg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e8abf7b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5335,"size_decoded":6356,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"dfeff323bd4b90190b6b69586b2ad5ac","sha1":"3d3c2db71b01b7d71df7fcf479f304b3c1c371f9","sha256":"afd70da25111796e3082f93932ead0fcfe19eecf4d908cc484e1c2c33d5df94a","sha512":"8ed40585044e1a204b8b749e23638431ae87d61adfff407d979f36c986fecd8793bb203e292fa1849bb6ef66ff5b871723b80f96c87d1fd3d735dccda60d1dd9","ssdeep":"96:ZmZrgM2/6fK3I7G9dADPhFYciHOWJznvRnIeOPyjTtHWw7LFUgUVzWSPNoA6:ZzhIK3w2dcPhpiuWlnFIeOPII/VzWK2","tlshash":"0db17d003b57f99af41f153492b0403aa771ca4b21b87fb3f7160d40279a19a3ba8be0","first_seen":"2026-07-22T10:07:06.218536Z","last_seen":"2026-07-22T10:11:44.555529Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-7.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.847Z","timestamp":1784715070847,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-7.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-7.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehkdifqc1f9-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Lr5vykR3UsueI55Vtk0vAT%2FVAPg8%2FiJsdtC34%2BA4n1Ql0xTsM3fBlmTFjm61oob%2F0e7JIoH9fIvec%2BKC8RXXGwtrb4OzTJ7CKko03hVHy7JnGq3OrCTGfvA4wwybLw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8cc06b4f7-OSL\r\ncontent-length: 865\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1845,"size_decoded":1893,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e8b3615d2aedb57b2a8a05743dc19942","sha1":"de888fa42355b9981c9ef7aeacba110777869dda","sha256":"591f7158f493bc901823bfcb261ebc92a07cf2efcf01f4ff8989cd38c8bef8de","sha512":"d2ddafe3922b927381b35d0c4ef55d62d183a475432567d3d8be4acfc293319a92b3678da38c39970279ae6a455f1ddf8f19d2ede4b6d5e33ff7efbb86f7343b","ssdeep":"","tlshash":"113100da7798e3e0c947d3f4d83fe86a36513c762f06c988d2e43a68d6016dd988c852","first_seen":"2025-09-23T10:56:20.336269Z","last_seen":"2026-08-09T10:37:17.299631Z","times_seen":81,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/horror-house-booming-games.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.461Z","timestamp":1784715092461,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/horror-house-booming-games.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/horror-house-booming-games.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\netag: \"dhcvecwy5gmpq3p\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QXcP8yu7yeNjn5%2Bu4O235tzxd6pk8nLZJor6o88r7mbp34sckQ9ZKUveUVa0JFVM3tHLZupaVp%2BMymKx0JjW4i3DrIECEKrR6jzuiBOXFEAhKrJKeVcnO%2FyUk4izxw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a96fd865b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33829,"size_decoded":34846,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"9e0824d8e065b737c19379b4ec156a7d","sha1":"5a98cb17d2081c76c5f423c07bb7509b5ce6da32","sha256":"252a295239371339591f1a62f87efed98f562c5b8f6b3fb0ed15d8cd8b903f29","sha512":"df1a582957b53946786064828953f91ebfc26db32f19ab33b15e19a97960e2551fb2538144c6bdd558220840ab3d9d5e95d646d93b91e8ce034eebf15f30490a","ssdeep":"768:efvSGey8DWG/hu8fLg9iwwefWUvGbFuhX7/1tGsl:efipDv/I8f0i7Pwlysl","tlshash":"ace2e1727462c1a0f46c05bca42b81029dbdf2357eeab3d590e0df5bd75d36eb241254","first_seen":"2025-12-04T21:09:10.650049Z","last_seen":"2026-07-22T10:11:44.557002Z","times_seen":4,"resource_available":false,"data":null}},"time_used":394,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":67,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/50x-poker-play.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.801Z","timestamp":1784715070801,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/50x-poker-play.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/50x-poker-play.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecq9mmzch2x\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jY%2FY9qllRCTywGCwb%2F1GMzPc3sE2%2BhL9R63NII%2BLWtiLPTTF4cl3gw3iMaPMLQKmM%2Ft1ZEEejbn9NZHmyV2GVWtiQoyjlckDeFkj1Az%2FiySxEpgUZcpF1uoaUe9Fcg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e87bdeb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22137,"size_decoded":23157,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"e6aa81f76b63689b890fd633b46df3ec","sha1":"39d93cf6f7f9ebd9364f33e9e10fecb507cc3603","sha256":"7b5a68762509b4f455e38fb232ccdf30289f58a66a174b9cdad899ecc5c2b4e3","sha512":"af26a6f67edfc49e4ed4ae2cbb787c368d378fe7a9421be883c98eff08cf4fe66f33a31caa5603bc67028de164de333783e1720962e5100d250c78ce28daf637","ssdeep":"384:MRp5ybmJsBeG+bqi6eDKnfu0MwR7dbY12Emq9T5Gy9Cfd19Vx2/lSfGzb1:ML5yCeNWvDKm0MwtVYELmT8OCdn2tN","tlshash":"56a2e18ea33ac61bd3fe8434622d183eb250737405a04bc9dc7abfe50b4e9b27c19508","first_seen":"2026-05-02T07:27:26.239853Z","last_seen":"2026-07-22T10:11:44.558171Z","times_seen":3,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/2026/03/banner-jackpot-69c5655c48e992.50137924.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:11.248Z","timestamp":1784715071248,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/2026/03/banner-jackpot-69c5655c48e992.50137924.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/2026/03/banner-jackpot-69c5655c48e992.50137924.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:11 GMT\r\netag: \"dhcxh7h3r01s2nx9\"\r\nlast-modified: Thu, 26 Mar 2026 18:33:28 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=4,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qE6%2BAIOmVoYYpOgL9PlE1htOW%2F%2FGnbN7EiPtry8tizU4Kej8Xd7fpsFpkX4aobpF8zcn6FpbMwXpagvCpWH1c4aBsVvczT%2Bo58Bl%2F%2Fw22f3AIFyvdbPySOuolYTstQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8eb4c31b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":124317,"size_decoded":124178,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 380x449, components 3","md5":"2f64718464df8292356b258a11c29110","sha1":"561817553e975b066ee8be5813f9355ac12d0107","sha256":"33b46671324a60e7640b87239a01d727282bb1dd5c4c3aceccec29b2395bbae1","sha512":"9a49b606202dc7b078fb9ddb04c44043c0dd6c505dad796314c02920577517f7acb0a75d603881857ddb9b65996f5bfc847d9d33579a60d2d2b6b13a5f97e21d","ssdeep":"1536:8Zktxj20FZwy0IMlfMayiqJiZuP+JhjDXlol6H5WcMxQ52ANP5SU31DVZOWYxxV2:Okt7ixlHbqJV+JrolC2kRS4UhbS9","tlshash":"5ec312b355b767c0db9d9676970b6460efd04baeb98cdf2c0d830909f5a0ed68183728","first_seen":"2026-07-22T10:07:06.309124Z","last_seen":"2026-07-22T10:11:44.558781Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/magic-stars.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.399Z","timestamp":1784715085399,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/magic-stars.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/magic-stars.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\netag: \"dhcvecy7ecl2f57\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BVAeKvk19FVTfjZDTTWgxtS0%2B%2BE0CjQuKNDAGcys5vJatIZFucxuPGUBl%2BPUUKzCqqyCwj29971CTLrziGGoaeZdHGcrUPUI2xuG1ZhQNYffyVuv7E5RjO%2FEkjPDDA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a943bef4b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19627,"size_decoded":20633,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"d9eb4e38d4e7cc0c478cec12edf56d08","sha1":"b7f12e6f9d70b12faeb6293e0f7559d8473d834d","sha256":"a838a661cba633cf1f441657ed0a23e5057105c7a62d58386874a4977d5e3127","sha512":"f631d220d91d7e086c8c6dabeafb0a7967289e64d8edf97bbb46e55e2ddab8305f204960e6bbf3c26ef9135c9d0fc716c3b921028ee18d65945f8101e006936f","ssdeep":"384:X1X1FEtRfL/ifu4LEIdviFM5NsdHl+eM8mNGzv4kfIAFs79oFyaVTH:X11FEthL8uaEW64eT+NdGAkgAFswlVj","tlshash":"4392cfca7184320ec742f831926d4f139c902b4987be9dad6ceaf45c837982c6e48d62","first_seen":"2025-12-04T21:09:10.72745Z","last_seen":"2026-07-22T10:11:44.559634Z","times_seen":3,"resource_available":false,"data":null}},"time_used":359,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":338,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/razor.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.834Z","timestamp":1784715070834,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/razor.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/razor.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecp9woa54t2\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FWwVzAigTDEPf0yTBd7MfVSfSmk71%2BdAQ8GccWL6EYG9%2FwURnUKVkYMtSOUvj7VAYnIlJVqecCYaCyr0Xm%2BFap0xTrqHzSMbFdG%2ByTOTc6Z4x%2F2ZbySN96CqF07WHg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e8abfbb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6230,"size_decoded":7243,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"16bf88c53e3ba110f8b4cbbac0bf6ca4","sha1":"740888090ed9e9a71ecd55d3e0c19c23248ecb6c","sha256":"4afa1338312e148f3176d94eaafa94e7a3d0db4d2ba3bf814479d91153616284","sha512":"da75ba150b11e6cb4922ac76010877db9ad3a722bbc68648ac37230b43ed54ccc3f3bffb00efb1ee8e950fabcc3f4fd35db5a4035f72c23b73f8cd8fab9e1d15","ssdeep":"96:dyacYiqNgIrPuRXmHmAcLWyvVtbDkeHOhLgSp9vHBzP7Dyrm3V:dyaugfRkWyvXfHkHvH1zV","tlshash":"33d18cf79b20c0b9fd1dcb7711a4062212693d31ad656fa198f1852adf593bc148c13f","first_seen":"2026-04-09T21:54:52.128423Z","last_seen":"2026-07-22T10:11:44.560674Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/1.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.859Z","timestamp":1784715070859,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/1.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/1.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehj49js11be-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=S%2BDorpBbxFKmJWCNBKqDiDiacXC184BDIXw%2BfaVQNrplHsAxOECnRJ0TKEVerTVTVT0OUEeM9%2FTM0g5rmEtlo7Kn1kfP1cz7479fnzbrtRo%2FjE%2BHfzWaEV9yOIssvw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8dc13b4f7-OSL\r\ncontent-length: 712\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1706,"size_decoded":1729,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d7939ced2f00f966d96df6259b176181","sha1":"ccb852adadddde6148885995f7a9830b41fcbcca","sha256":"dccac0c3395375b36619af3a3f58b4246a3c9e80539f383873f8c9d0805a17fa","sha512":"faf4cb8a3733e770bd494bbbe39c122a91d77795282db091f4906fd9de4c5cc0100ed48a1964d144d6bbfd616caada42feb7d86e625a6c1e0679df199faaa817","ssdeep":"","tlshash":"a63150fc33dcc9e4550be3d0d335180a797b38f96f9ae71d80e50918eb181ac4ae8884","first_seen":"2025-09-23T10:56:20.41091Z","last_seen":"2026-08-09T10:37:17.187324Z","times_seen":97,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/vikings-and-gods-2.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:33.315Z","timestamp":1784715093315,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/vikings-and-gods-2.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/vikings-and-gods-2.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:33 GMT\r\netag: \"dhcved23wh2necw\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3qrDbzgmsH2Z55y1kdfHzgcF7dH%2BNN35t5U7I0zGCXSb1NfBL%2BSNwGkRXxEr8YzAE5yqVpldOqy8Fwzc%2BER1TbEbEVH3bu2zYtJsmlJRD27mlwrg9JC7iTdrgohaOQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a9753896b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18608,"size_decoded":19617,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"ad456b82c6ce90fba89c9132e3a0c839","sha1":"c8b3afb4308f0ed5277dad080927e68592891bf8","sha256":"120be35c68967d7542d3e59ab37be4de58a4f01edace5346496807e4876bd8c3","sha512":"c8080d607679a3cf7d5bfcb10479b17e822df521014fdcf4c92c71408bb71844b88529f8018c53c02d70e47501e24e2e29110cf036d1dd7646997da9c7a92f08","ssdeep":"384:2ck72s/25oA0EGJN2pUhgJ/XJnOUhTIjUrBVDU3:u2NBs4UqJnBhToUVV43","tlshash":"9482cf9647f41ecdd04c06f9ddb6027e77a42d95a06b2b460041d4e252333bf0ceaeb9","first_seen":"2026-02-02T10:45:14.640393Z","last_seen":"2026-07-28T16:30:26.612598Z","times_seen":4,"resource_available":false,"data":null}},"time_used":360,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":339,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/2026/03/baner-1-69c5655c676091.90060182.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.791Z","timestamp":1784715070791,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/2026/03/baner-1-69c5655c676091.90060182.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/2026/03/baner-1-69c5655c676091.90060182.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcxh7h3r01scmxv\"\r\nlast-modified: Thu, 26 Mar 2026 18:33:28 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p1ygbTamUCtz16JR4eO62DBDpuKYk1c%2FVTsTJ4DcvM0AU5msoBJ19Imuk4dU4ydVlyd7lLwJAK2rKzKK2FtRCCPfQ3AFDIgK8Vo62euhhfFQ8wUzJwpn6DRoyRt1zA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e86bd8b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":589603,"size_decoded":589290,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1280x680, components 3","md5":"d19b4b5f6d8b5540f75c2477a6e23473","sha1":"dbfeb6779a28df2fdacef071861ddcbdd2d90f3d","sha256":"d4fe7d34976c9bb872dd5efcbbb6d932c0da1d7b45b5f9acca3fd280a094cb50","sha512":"d8ac4b419e7ca7761534d2e94d855186141ed7077ef111aa661a27c58a7a5ad361dff8719619c95424bdf264fe190f7d060a29345436fa88ac9720b03bcd01a2","ssdeep":"12288:M+fzqaybrzEr+K4GC+rOsdtf4btQ34+EK457kKET:Hfzq5rEZdlOsdt0CDHT","tlshash":"74c42320af0266ab9de96370e787cc992d5107df69a25a4cc90fd120a77cf336317a54","first_seen":"2026-07-22T10:07:06.288132Z","last_seen":"2026-07-22T10:11:44.56218Z","times_seen":2,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/magic-stars-3.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.803Z","timestamp":1784715070803,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/magic-stars-3.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/magic-stars-3.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecy7ecl2q8o\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DiQfyHcvTkTywHj567EqUyE%2BfluPSBuP%2FzbB2tcdwJJEszKGH6S9vgSxWAWHrm9K7Ofi9Z6lFKbuiwGefJczNuxlHiUTOt1%2BeopgmhTjClDaajaRb%2FUmInTlrWyVlA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e87be0b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34008,"size_decoded":35023,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"b98beedeff406aa1a195c6aba2a6fbb0","sha1":"e69ca3674fd27d9253d278e6db6cec9bb849a892","sha256":"5f2bf66a96359cee86712b12ebfe9bcaefeaf7e65fb706ac14a977d9d170a62b","sha512":"a2ec0d9d0e912756116e5ace93a12cc5a49a1a47e680feb0be71750aa53a9ca7abc18f1ff4fac2d987c850765b69e7aeb7b9b94c7fe9c683ac3c57cec71b4143","ssdeep":"768:8jFd0Vy9BjUzw9rQQWh7zk0jLsUVNkrvFlh/sN9TVZ/QIa+Jnuky1E:e609RUzkWJvjLjEFlhkNBf/Q5+Jui","tlshash":"55e2f1833548d190ebcede287431a73b468684073c5e1a913de58c617b761feb6e83e9","first_seen":"2026-06-01T01:17:45.288631Z","last_seen":"2026-07-24T11:50:54.435555Z","times_seen":5,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/live_icon.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.860Z","timestamp":1784715070860,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/live_icon.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/live_icon.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehm5t66x1y5-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mlZwptgww%2FbA3xGa54z%2F21surNdHDLfsF5Jh9K%2FoY6G3pVg8aW7TePZWv%2FR%2BgN7q27ChAlIffx3WKWGK0GfNbniPL1rLEt1KOTRdgwcMGtLm7SRQqQ7a9%2FlD3BIoGQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8dc14b4f7-OSL\r\ncontent-length: 925\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2525,"size_decoded":1946,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c9a0c05ebadf4fda67faa8b90d5424c5","sha1":"f81ff1ed17b5ffba223d3a06d1a3628fb198cec2","sha256":"f8dc8454be75f1a4ce991b485bbb1f1650428409c820b3d9b8540fe5a538dd45","sha512":"ff6e2ddf5f392b184b7d49f702e314ff8cf3af53e7eefc4150dd84a863a30eb627a9dc6f0174ed3710e72ce7ae9831f52bac374779670d653e3d78914bb63616","ssdeep":"","tlshash":"4d510ef3e2cca2d19003d7e4cc079831b59b6cf767daa3cb8272ed44ab30165598d865","first_seen":"2025-09-23T10:56:20.264777Z","last_seen":"2026-08-07T10:24:40.823982Z","times_seen":43,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/2026/03/banner-square-69c5655c5fbb24.17748615.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:11.244Z","timestamp":1784715071244,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/2026/03/banner-square-69c5655c5fbb24.17748615.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/2026/03/banner-square-69c5655c5fbb24.17748615.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:11 GMT\r\netag: \"dhcxh7h3r01s1rgl\"\r\nlast-modified: Thu, 26 Mar 2026 18:33:28 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=4,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4mNaYr8UozbzbOYuTqBrAAwCd8IMOZOHQ5nDIkCiXu49NL6O7pVSEMVK0bG8ZG85hUAP0KmPY9fUxZN67Kg%2BGbXR6wbO%2FvD0N4SU%2B608K5yxiW9nInTEjNLLDW8Jbw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8eb4c2eb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":82245,"size_decoded":83290,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 360x334, components 3","md5":"01040b6d00ab139e5028d311c02b6890","sha1":"30f9d147527c1a266be4db1c1759bda418b4ab61","sha256":"ba8d2bea2ec848620a64695f5f07c35c579bd81572171ba4c02f390297dba3e9","sha512":"5f5a76dd095975be9411260bb754dee4feb3afee9b05366e81a2a9d8d4856246b7fa36cb1b9af37514f07dc3732a23f321d2b2fafa00ff70fbf6f9cf0e9dca04","ssdeep":"1536:vJqkZA0gnSYCpWBqG3H8UkDle8aH6cKij9qZnQQcwtKlH9HUCN1gx/P91M3epWL7:hbeE+3H8U8Y3j2n729Hk/7g7v3j","tlshash":"e983120cb4d0860134ac5897fd4a3f9ba7558fd2e6546f017cd2b8e2fb8a207497ba74","first_seen":"2026-07-22T10:07:06.324988Z","last_seen":"2026-07-22T10:11:44.56427Z","times_seen":2,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/diamond-dogs.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.397Z","timestamp":1784715085397,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/diamond-dogs.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/diamond-dogs.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\netag: \"dhcvect8sj2zrv6\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UGd98BCqzv2kcKkEvkU0QAu7ENQjvWlpEYrZsnYjEjgyqVJX0VavV5pZI79gWJh4lL6g5Tmd8n404brWGFBOP0xjIrF%2BWnUNlfIF8yeVDRbPuHYW3ysW%2FEdsDXuqFg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a943bef3b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36114,"size_decoded":37115,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"49b81d0f07e93fdd3960767c281efa98","sha1":"d93bd8165e57a8eb7d89c5bdefc318c14f87c9b7","sha256":"004c7bb044f032928fa488d7f6625b64e40bd125a520be96e6f72b06cc172b0f","sha512":"fffad83e825c80ca2a2374e4684056b04b332a406959cf503fa15356bd94194e2bb3fa36e4d446f3439055a7a524157860aca666a23b18a422bf260e14cc45a2","ssdeep":"768:Pngobh00yfXfnV2j8i6Ftsbo//A14YfRRvisuPOVI:PngshSvBsZQ32I","tlshash":"48f2e1106b0cded16b7d280c3e35dfb67725f478a8101c9187eaf1a8a7945af80b0ae5","first_seen":"2026-07-15T08:05:06.961299Z","last_seen":"2026-07-22T10:11:44.56487Z","times_seen":2,"resource_available":false,"data":null}},"time_used":481,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":403,"receive":78,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/ajax/game/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:31.962Z","timestamp":1784715091962,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"POST /ajax/game/ HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 114\r\nOrigin: https://rainbett.fr\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":114,"data":"{\"exclude\":[\"2203\",\"1878\",\"2004\",\"731\",\"852\",\"1395\",\"718\",\"1424\",\"751\",\"2084\",\"1434\",\"1551\",\"2180\",\"2446\",\"1033\"]}"}},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, must-revalidate, private\r\ncache-status: Souin; fwd=bypass; detail=UNSUPPORTED-METHOD\r\ncontent-type: application/json\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\nexpires: Wed, 22 Jul 2026 10:11:32 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Xj%2FyG7sYQXHbsMGWnBF1bqFQY53BtmD%2B6Q2Qtctbod03BmYao6HyvxXwHgi51Ei5qSE2%2B09vAtyofBp4WpVM1IbV4otK3AiA8TJFZavmCWeVOUvDH%2BxAiQaqaKkflw%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a96cb841b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":96,"size_decoded":1039,"mime_type":"application/json","magic":"JSON text data","md5":"a92a34172e7090b45f9665cb8fa184ae","sha1":"856959d2d01954967e4bcb5fecac276289ef456b","sha256":"173c92e6ca096cb7567242687894b0dfc2498da35cd7d48dc70f0ed1c7740ef5","sha512":"e4e4bb21c2d7bb19808e8b8b58179fdee7094c92ba0f735d90003f1c7743f4f4fec3cbf8671733d69263fcdcdbadfc0ae1b3ac5c77732489f2bfd8b370b3c2ff","ssdeep":"","tlshash":"5db012da4110183fa6271304c45630d010d18d4304976c041a4889c1056d5030013d01","first_seen":"2026-07-22T10:11:44.566296Z","last_seen":"2026-07-22T10:11:44.566296Z","times_seen":1,"resource_available":false,"data":null}},"time_used":344,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":344,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.782Z","timestamp":1784715070782,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript\r\nexpires: Fri, 24 Jul 2026 10:11:10 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=l0zw4Se0N%2BGoTj5g9d%2FQBIzTMKgJ4WsiUYaes8D6HICWhbkIZuefqCoAWZU1XjaDCTVJ5p6Xfo4kPjSe2Yx%2FLdgmuRAYjmYZ4GlzXfy9sCKWNaSoOreSPSlpjoN1wQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\nserver: cloudflare\r\ncf-ray: a1f1a8e85bd3b4f7-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":1288,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-12T21:53:45.193528Z","times_seen":418734,"resource_available":true,"data":null}},"time_used":3,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/2026/03/banner-popup-69c5655c527e87.87416433.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:16.958Z","timestamp":1784715076958,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/2026/03/banner-popup-69c5655c527e87.87416433.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/2026/03/banner-popup-69c5655c527e87.87416433.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:16 GMT\r\netag: \"dhcxh7h3r01s1dnz\"\r\nlast-modified: Thu, 26 Mar 2026 18:33:28 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=4,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XPtER3NDZgUvUtza1P8VOf%2FA%2BiTI5I92KQL4%2FzdaQnepLnUZXJyAiigYvyAYIGeeUBhSbHkcwGT17c%2BNh3Wizu%2FYupATScNrfA4ILb69JbX1LFyvZVJJLxfl1xP38Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a90efd10b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":64367,"size_decoded":65410,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 450x342, components 3","md5":"8e5da10818b11f81f4a85f540152a088","sha1":"868c329ee0da0f03c136040acc29af1965bb646c","sha256":"d02525189b22bee1abb57bcca32a59a68f59c0887de196d1f58ff3c2812f5147","sha512":"9abd2d3d967e45265b5fcf01f0de7e69464c42b0a841bd9c56745991b7867bac527a3d17cce17f6c4c08fd966c9dbf19ce74017dc17bcbeb18ebca725c3a23e0","ssdeep":"1536:xvd5Hfl6SMDFvXF8dQC96TOmE6GclSPfjukwHLVacibcv/j8RQ:ySofF8iTJar2HQcwc3j8RQ","tlshash":"dd53013fcc8267b50d4d9b944851a3a116b98b8a79b4d3dcb2d0c030f3f5a80766779a","first_seen":"2026-07-22T10:07:06.227632Z","last_seen":"2026-07-22T10:11:44.56779Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/ajax/winning/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.010Z","timestamp":1784715092010,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"POST /ajax/winning/ HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 110\r\nOrigin: https://rainbett.fr\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":110,"data":"{\"exclude\":[\"398\",\"2548\",\"2095\",\"254\",\"557\",\"2190\",\"2261\",\"934\",\"1683\",\"1623\",\"2610\",\"2525\"],\"locale\":\"fr-FR\"}"}},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, must-revalidate, private\r\ncache-status: Souin; fwd=bypass; detail=UNSUPPORTED-METHOD\r\ncontent-encoding: br\r\ncontent-type: application/json\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\nexpires: Wed, 22 Jul 2026 10:11:32 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ulbTg4%2FUTbkBQIlYMprRQpF%2FJWbLZ3rrwTX0H4FaQnuIEqugPBn8IgezqGZxHozp1AxodZNM4v5p%2F7RBAPzOUdNK4NEsPCbjeCN0VXBFFE5VqFxtFCvIDFaY0rjKGQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a96d084ab4f7-OSL\r\ncontent-length: 565\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7510,"size_decoded":1544,"mime_type":"application/json","magic":"JSON text data","md5":"59ae421cfbb38c325702ff19fda81538","sha1":"9839ed09864a8984bb1a01b7abc3ba1400c2036a","sha256":"d8366e4f176da0bacfa28ef6fe76c30b8ae1d06e29cbc8b316049a3b73d48187","sha512":"8e35b5ab3b93007317538e902199b169be813e60a5255f49403ceeeea22480942223a2bcc3d27f9c2b762a6f7ab76df57993cb13e54ee0770fa14957c55f7f95","ssdeep":"96:Kf8fRJDf/fRBSfVcfRURfWsfRRcfkfRozfAnfRMfPf+fRJWPfCZfRFbfEfRyRfRB:DUOPI","tlshash":"3ef1ae266e61e33f71c760e0ccb7efde1008e966902c4428fdbf15a6d7224145f99a1e","first_seen":"2026-07-22T10:11:44.568934Z","last_seen":"2026-07-22T10:11:44.568934Z","times_seen":1,"resource_available":false,"data":null}},"time_used":417,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":417,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/ajax/winner/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.015Z","timestamp":1784715092015,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"POST /ajax/winner/ HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: fr-FR\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 85\r\nOrigin: https://rainbett.fr\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":85,"data":"{\"exclude\":[\"551\",\"617\",\"804\",\"806\",\"384\",\"914\",\"481\",\"171\",\"218\",\"639\",\"931\",\"875\"]}"}},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, must-revalidate, private\r\ncache-status: Souin; fwd=bypass; detail=UNSUPPORTED-METHOD\r\ncontent-encoding: br\r\ncontent-type: application/json\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\nexpires: Wed, 22 Jul 2026 10:11:32 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I%2BZuezrHUH5fWJWuV4KTbyKaVj2UW5L7uuwYrVpR9hWfnl3aouvtPeha6nf1MZIiTsDGEqA7ZrE1wWLXCzR4dLBxfzFmGlenp1lklYiElku0qQ0cJ2ByThmbo1SmFA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a96d184bb4f7-OSL\r\ncontent-length: 239\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":595,"size_decoded":1214,"mime_type":"application/json","magic":"JSON text data","md5":"f95c76dc389f2a502e404e1e99204d81","sha1":"2501fed57fd9e4840bfd2d45df56332baaaed832","sha256":"2462777fdd9cbc23a1fd2915fd3dfdd13937ddfbb24393e37571f06c13886b13","sha512":"547cb7704e2cb0418dc71427d54854d9880faa784bbe8679f675f111d92ed29872ff7f983c28e1c879e6e90a9ee1b6bda863fa86270a12dd58a892686422bc1a","ssdeep":"","tlshash":"acf05e92aa11a33fa28351d0dcb7efcd2444e952952d8434fcbf59a1c3228646f9870c","first_seen":"2026-07-22T10:11:44.569884Z","last_seen":"2026-07-22T10:11:44.569884Z","times_seen":1,"resource_available":false,"data":null}},"time_used":376,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":376,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/mirror-magic.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.407Z","timestamp":1784715078407,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/mirror-magic.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/mirror-magic.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\netag: \"dhcvecygx9u6ii4\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k%2FxROT%2FYxjKJO1Fs0zbIFRH8fXFxaMdNVkOc%2FMllnTQ1Ar3ADHdXwaz8rWTeuNBXO2PwNAm3s9qi5eTmOpwiJ0BxENXY9NERwmS%2B6mlb%2BwXInYQl4C4e3RDrDlPgIQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a9180d46b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23980,"size_decoded":24987,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"effda586f179697df94401ce58c82a28","sha1":"abab27b146b8c41106bf150b564cfdce7758b533","sha256":"fdd1a9e3cc4534297c91f82606752750ef60a5597c37993669c31fe2c4728525","sha512":"e2e55451c12b6f025178bd6a4ced0434fa5bdc68809d68b8cc2c7ae2ba52e1eb8e6d152f1c4821b7d97e0f10237a979fdb8a90b05830764eddd20453a67668f9","ssdeep":"384:Gvp1rPKbbn+fpFAr+eoA7tQdhNCnSLQ86jqNdHguviHrzMCnC7W3zjwxDxzq7VY/:GR1ubbo5ep7+d7OSc8VPg3rnCCezq7pW","tlshash":"04b2e01e0a2e633cc76e99bf367d6b705c044a0b2b45e84e6d9dea693a564c05dc80f2","first_seen":"2026-01-12T23:19:23.846907Z","last_seen":"2026-07-22T10:11:44.570943Z","times_seen":3,"resource_available":false,"data":null}},"time_used":415,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":358,"receive":57,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/roller-turtle.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.398Z","timestamp":1784715092398,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/roller-turtle.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/roller-turtle.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\netag: \"dhcvecpeo4wp3a6\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=15XN%2FWbH%2Ff72Oh%2B4Hwf0n8fVLCBYzx2bkBTo6oDqoQskO0x%2BnEiB7xIInkAO4CJA6aynDZotL%2F6xhFktXcWKGtBr1tkR93UH%2B%2BVEGbrNNk49Xt%2Fz0mF%2BxZ7ShG7oOA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a96f7859b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4254,"size_decoded":5229,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"b6fc82dc162703576819a0f7cffd48a4","sha1":"db6357a9470988e44d7d6f2015a16561e2062554","sha256":"f0872e1f9d6c2caafea1874dd85143f591c2aeacb5cc65f46ceda8147b8a403c","sha512":"0325cdc07cbdf94d03b5fd56a041403b7b5664dcb7dbd23107bc0ee075cfdf9d309df4e7929adae93d2d7a5775bbdb6c8a0f9a72d3d8d8719249f8341a9cfa36","ssdeep":"96:Q4PYqx9LfnU4dB6lUXL2HTt8W9fdsJ9RMeMZC7wFIs:JYe3P6ljHTt3fdM0eMZ/as","tlshash":"02917d270f380443f82d6af4d88493239e81ab37251e391e2191fa49b3f9655dcd10ec","first_seen":"2026-07-22T10:11:44.571464Z","last_seen":"2026-07-22T10:11:44.571464Z","times_seen":1,"resource_available":false,"data":null}},"time_used":130,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":130,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/build/frontend/app.css","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.767Z","timestamp":1784715070767,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /build/frontend/app.css HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/build/frontend/app.css\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvgu9z3th61jhp-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:58:57 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ba23%2BSgsSpniBF%2BOAhsmzWx6Lvx0pZzMyoYfG9HBa6mJAgG755R3Cq8LtSmtbWF55gW%2FGRIlzyMuZ1iETvnpt0JAmYvbkxbyhGMOICapmB%2BoKP3nl9Jb%2BChioT3uaQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a1f1a8e84bd2b4f7-OSL\r\ncontent-length: 12062\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":71917,"size_decoded":13102,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"c322942566a347c47e4c4bbeee3ab0ae","sha1":"80cd278c091f3b36e27cb46fd99482a2ec55dd44","sha256":"22062a83fc1de42b368831e86c0d82135e75c03adde693987fd2edfb6d6a12e9","sha512":"8f26d5a7f9e6f7e7c565b471439f7b3b6e89193d9c01b7df36bf7e9f0025c3e9e5e4d576539a24a4cda732b121448133a7b69db1baba57ff2917bae2c99af548","ssdeep":"1536:LD3Dl/j2XpU/9w/nOPTKAnI92CHDlygyz:kXQ","tlshash":"10635323325a203db43fc465a8d0a69d712cd407e76b57fdee52a165c9ca2d31b33b88","first_seen":"2026-07-22T10:07:06.3202Z","last_seen":"2026-07-22T10:11:44.57238Z","times_seen":2,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/build/frontend/images/plus.43e37ac7.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:11.250Z","timestamp":1784715071250,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /build/frontend/images/plus.43e37ac7.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/build/frontend/app.css\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/build/frontend/images/plus.43e37ac7.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:11 GMT\r\netag: \"dhcvgu9wq35web-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:58:57 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OIi%2Fg1YmeMFQySk9O8EHN0mcDV7kAaIffZxq2HIEOArF2ZIGsec9mf8XH1Qc9Z%2BvD2tPAVE6AJ7GeF4IWBhCvHDot1xyRsNY83ZkUUz9HrBXlVpmSqoUDkXvChuq8A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a1f1a8eb4c33b4f7-OSL\r\ncontent-length: 249\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":515,"size_decoded":1283,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"646a796cadd2dbdcf35566f787a5e050","sha1":"bc94144a89319dbe46b004b00c68d7975c21dd5c","sha256":"68aa0abea8559a323e42fea3fd266226bf8d331b54e68e8ef8af1ec1c46ee98a","sha512":"06f6083b4644559ecd1113212054f7853919d0f4261bea6827ba3eda6aa4cbc884a6311aa9e3a8feda46f6425b2a31edf5973f588ae13bf29e9b24c5ab2c0539","ssdeep":"","tlshash":"edf0599563cc4e3cfb254a10e3497234402a66a296ad4108f67123712a282ae693f7cc","first_seen":"2025-09-23T10:56:20.515431Z","last_seen":"2026-08-09T10:37:17.351558Z","times_seen":87,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/reactoonz.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.460Z","timestamp":1784715092460,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/reactoonz.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/reactoonz.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\netag: \"dhcveczbvrwtnb7\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nqNPiJFQjwixyqFlBdlDiH0T5JzvNxpcUUp7Z7fvgvCIO6MoMFHsup7%2BKTG2FrHbhZaWuNyOLMOQQ8b%2FF8O6aFtjNY%2F4WaWDkpcGOYQLkp83wRi7%2F5ppI6mk5RnOTg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a96fd864b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30211,"size_decoded":31213,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"3b314dd1b7145877062faa1dffb6700d","sha1":"46225e0171efdc56f5ffcdef17fd6ff505157b4e","sha256":"241ae692df586ebce099687c01ae85d278a9add8f7c9421463ec3134d9e96f75","sha512":"ae5443d6a4cacaa0651319250e3d0b5b17f754157e02b0e39e3195a54f452360b9421baec16a80d4bdf4d7f70241d2ccbaae82e761c57165e76bfc3632f7c1c0","ssdeep":"768:g5D2kN/f8q0k1mgqoa5KFo1mUkNJ264md3dTAfh:g5D2kZf8bg5Rd26RpAfh","tlshash":"76d2e13e17b5a49a141f483c8994dc39538c588152fe3f3d959099323bb56c6dffb0a0","first_seen":"2026-07-19T01:56:28.759146Z","last_seen":"2026-07-22T10:11:44.573562Z","times_seen":2,"resource_available":false,"data":null}},"time_used":435,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":371,"receive":64,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/18plus_icon.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.864Z","timestamp":1784715070864,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/18plus_icon.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/18plus_icon.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehix4cu61ar-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ifohakeCRiLSk0tNWzDcuwmLhqQCDAMUpX%2FYns%2BOYRP1YZCv5xb6k%2F0r%2F1kWFrM6LE%2FtMZPP%2BffSAUl%2FlcPv%2FuSqNaRHFjKHDrba3Mg3GqqNtMULCL0PuIBQjjgZ8w%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8ec18b4f7-OSL\r\ncontent-length: 682\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1683,"size_decoded":1709,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d0f9c719dd4e1c3f2c9f15960daf78f3","sha1":"01729b3afd78d2cc88d50ab64459d0238cae0b0e","sha256":"eb4781501da6404c234bce791187043ffd8b76ff71ed4c47bc642bf6983b9b8c","sha512":"b46d36977240a08da3731fdf869363ba9ee385d0a546a716803a98675d8e3cb825b8a42f070a1a0748d87c08dd526597805802253639a509e98eff6b5b1e2e7f","ssdeep":"","tlshash":"d331ccb7abc872e4d64557e6a07a7518f67530fbbb5acf05818826647a0117fc1ccc44","first_seen":"2025-09-23T10:56:20.497394Z","last_seen":"2026-08-09T10:37:17.212854Z","times_seen":66,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/2026/03/banner-rectangle-69c5655c586729.09910693.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:11.247Z","timestamp":1784715071247,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/2026/03/banner-rectangle-69c5655c586729.09910693.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/2026/03/banner-rectangle-69c5655c586729.09910693.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:11 GMT\r\netag: \"dhcxh7h3r01s2i55\"\r\nlast-modified: Thu, 26 Mar 2026 18:33:28 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=4,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=E%2B35m2AjHy6l%2ByVXtiF3U%2FeeoKB07IduiH88RnceLLgz9LPzB7ZHk6VEEP1ExuU08syDiXMzI8Tx4LCRLEImg0JSwGZiyzi%2BPWb02a5C2zUuU4R0GpWY2SDlzNwvIA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8eb4c30b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":116825,"size_decoded":117875,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 636x340, components 3","md5":"0046a02202ca755f220b10034043c9c9","sha1":"ffccc9ec2c4b79e9cbc2e21f59880e3257b18014","sha256":"8f51387695ed72ff133322a96456a2d98c6d23ab33d5fd366a1bda16119fe9bc","sha512":"d7c484ff6c3fdb4a0bdf812f8b92a86e8b89838c94e48920988f078654cf8217d28320e98650db5de654e5beb164f4525bbd934129794ef1dda09ba411f28bfa","ssdeep":"3072:n2niUAsNyyXmH285O7t47/IRmY7uNzEntFAsnb/5yc:n2nCsoyXgO7t47y7W0b/5yc","tlshash":"48b31284371655e06e3f8baaf1ef6686d6ad110efea34e15cf09682cd214e08d065b7c","first_seen":"2026-07-22T10:07:06.336379Z","last_seen":"2026-07-22T10:11:44.575368Z","times_seen":2,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/the-expandable.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:15.593Z","timestamp":1784715075593,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/the-expandable.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/the-expandable.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:15 GMT\r\netag: \"dhcved146ider0m\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9JsVeqxZ0S3T4VJrKrb%2FWZyRBNHWlH9M%2FHKdOz82Zy5IpNSOND75LoWD8XceAf0c2pdLS8C7JQMbEw5yTW2WAWLZ5XoqmbZ6KVbs4sZyden4QawfYFgF5PuJ3kzGjg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a9067ce1b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":35014,"size_decoded":36017,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"afa43297a11f64cc713336f3e2a1a35c","sha1":"05a80f9710129c3040fc37f8c3080b977f786f3a","sha256":"276a708fee3ae7355a42987b563391aa9a5a32b5a696779bbef33f660231b93e","sha512":"cdd027ee7896d655cdebd8d6b3e16014d3d863d7fd5003302dfab54f3b9c625d67ce77825d539395536684f98fd4ece1519169391e0732c679124f4e715cf6d7","ssdeep":"768:F7hqgkCg11Diu0ZaYFY5eim7vAv4DAMaJWS8dZ7LrHD1pIxykaaeHnW:ZhJkCAiX9fp7oQhaJWRDn/1pIMkaae2","tlshash":"f4f2f16f75bb561dc23c9966cbfc3b19e997780a12970707ade6407c338ce40a061a3b","first_seen":"2026-01-02T03:19:50.95323Z","last_seen":"2026-07-28T16:30:34.13872Z","times_seen":7,"resource_available":false,"data":null}},"time_used":440,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":370,"receive":70,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/honey-money.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.807Z","timestamp":1784715070807,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/honey-money.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/honey-money.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecwy5gmpio0\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rI3cMMFgEdTlOszEG2cTVfdtGRIxgjB%2FAuP4nqsdaRLQepua%2ByGgwT5ohtNhsbcsJWE%2F2PxXz5UiuOqwtlIiuA1f8Nwq3YUDGalSSRdsBhxdg75l2FR3exKvCoGS8w%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e88be4b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24192,"size_decoded":25203,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"b1209cdc0f9798bf433940241db05f2d","sha1":"332b7cf85b0924133dfc777925e3a20e1badb37d","sha256":"5208eedd14c31fa044eac32a21574ed4b759c8567702d6ffcc10b367ed452e78","sha512":"802d70a764d3d8c0ab5bb7aefc197be1bbafad045cf644317a40e50a57d58fee01acaaea50aecdf963300075a1f854441186a3a76eab675db9a7d086cd8e453b","ssdeep":"384:xbIiWUwYjj+uP7vANKmCfT1FcsVX316i8bEvOiQl9/qn5QwKlQf8DXytPuLRM6MI:xMjU8uJm+TVXYi8bEPyDi1uLRl1B","tlshash":"f2b2f18ace25ca26e38e6e51e3c6cd35c6045e92ee0f27b19995144d1bd2f3b06e07a1","first_seen":"2025-12-06T17:29:39.374345Z","last_seen":"2026-07-22T10:11:44.576575Z","times_seen":4,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/previous-arrow.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.798Z","timestamp":1784715070798,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/previous-arrow.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\npriority: u=5,i\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/previous-arrow.svg\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mk42GKw0P1lsON76eEaIWPnqodftKEwsAQDcdq6lKSKChuRvM%2Bv9hOAx3U1GLOF4IISwaVTj0763ND0Dl0Xs%2F92%2B0YYJjQqnN9mYcV47dC062sKOcArPgK3Yd%2Facfw%3D%3D\"}]}\r\nage: 292\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"dhcvehnokzee6n\"\r\ncf-ray: a1f1a8e87bdcb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":239,"size_decoded":1158,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c984c402c33c19defa622a555ab1ca13","sha1":"0806b39e6f47d810a71a7284887ba8dcbe29551b","sha256":"a2cb3406d6dc745a6f438ae2b5c381141da3dbe56e664949bea2dfbcadbde1e2","sha512":"e3b4bf714c1b071b3d531ffbf3f2331765cc7409e1ac764a2d958457ea315415a5050b17fd2612b3f9b8555242b9329882d79554bce4f0638b0855fb6b9c794e","ssdeep":"","tlshash":"6fd0a7a953088e3cb2218b11fb29323570ad61a359881194da611a31a65456e7d7f6dc","first_seen":"2025-09-23T10:56:20.491613Z","last_seen":"2026-08-09T10:37:17.230615Z","times_seen":106,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/zotemas.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.823Z","timestamp":1784715070823,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/zotemas.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/zotemas.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecq03pq852l\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nvMAZ4D9Jw43pbpcJMvDm4rpCkv2EsBw1FZGxmrx%2BL4IC6P9aTWPEJ4ucfjzg5%2BAXWAxYfaPmHMCudlh98ex7oXg3GvIUsqiSKgWHmsCyk8pQP%2B9XuaT25jR7VJb6g%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e8abf1b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6573,"size_decoded":7582,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"4495ad5add9290b27f5b835f7106a204","sha1":"d5f776f70bfb201eba71e0cc1cf988c81aa73872","sha256":"f67873cc2efa9b46bbf14c48ae0fb625300b88a92df3c7effff9fa971d88fc8f","sha512":"3e3aca5a804cb5cfc85403feade6a3f718434b37e11250bff6e7fa6fbd1c6036ff08bff807c92fb3e65a1f529fc206bc490ccb0e71019a6aa0e6a65166f1839c","ssdeep":"96:ROgW524M8QE3CHPeJ35K6bPWUD3Z0jiSTlMTwuTaAhPs5kVEgrmKmFkIcVXxD:ROb5v/k2i6jWUD6dTl47Pse7m3mpxD","tlshash":"53d18dc107a58614d93e2336424da63cfba8db0ae592853311c23f3893192a9d6e25b3","first_seen":"2026-07-22T10:07:06.331143Z","last_seen":"2026-07-22T10:36:34.552884Z","times_seen":3,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-6.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.846Z","timestamp":1784715070846,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-6.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-6.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehkb4pf315o-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jy962PCrmnDDMg1jveCucFhzZ%2BiFLDSx5uE%2BF6poccnyUgZ5Jv8aWIOzGBctKxDkidaM72V%2BbPfsZxEZJS8A9BaD%2BcTjTFsR%2BVY5Zv0IGThO5mPIJW7k48gye9a6WQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8cc05b4f7-OSL\r\ncontent-length: 673\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1500,"size_decoded":1701,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"76e7c6b9226162c6d224ba11f90b5749","sha1":"e72249560379454a0dc30e52889ff7ed088bd46d","sha256":"967dff8aecee4221a3f0a65e2d5e8a47a2a08c872506bb4dec1afe2a023453dc","sha512":"a81406975f8973c57ea41cf56a867c2ee5eb438530c93389338c2999b36c71e370a27f8cc9fcb5d8a5469bde2e8d260479df05b0de24e84658430ba4614bc6fa","ssdeep":"","tlshash":"9b3199efa1d1a6e0b4838fd898147354399f2cbe3f0cca598181f6e1bd68b5c4488ce0","first_seen":"2025-09-23T10:56:20.508848Z","last_seen":"2026-08-09T10:37:17.360852Z","times_seen":81,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/gambling_therapy_icon.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.866Z","timestamp":1784715070866,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/gambling_therapy_icon.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/gambling_therapy_icon.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehj49js1aip-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z%2FaGIjXmCmNZBasl%2B8LbJMIf0rdFcU1sakYxmElrXcMG4KG38wHv%2B8p1jFgkK31XQXOK%2Fg7AnWyG5y5A2Rq0vaDARmxzII5M9ZJ9rUqFfj%2FWH%2B94gb6hnZz8WOLRnA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8ec19b4f7-OSL\r\ncontent-length: 5576\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13633,"size_decoded":6610,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c28a2ec537870b466539e977d126a642","sha1":"411fb06c13fece6d976e46adf4e1853f217e7dcb","sha256":"4dc1e85f5617c3e16712c08673aa0d62f148e3cd7927388fb07234e10f837978","sha512":"2c4523c09af461fa611146331221251e8ae5ede94f5d6553643be12c76d03acfbe144a2bc223dca00d734e22b18b41087a36c11169f773434cdf1da93c244e00","ssdeep":"192:eqDNRz+fDeLzFYUVqaqQ8mce1HLMajzj3ea+novICc+Q1+sBMZRN:eON5+E/VumjLMAzj3wB2H","tlshash":"5b52b5fab3d5b2e8e502e7f0e12584317faf34bbbba6c658c6842dd0e61100c5e658d5","first_seen":"2025-09-23T10:56:20.459959Z","last_seen":"2026-08-09T10:37:17.249222Z","times_seen":61,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/sirens-treasures.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.304Z","timestamp":1784715078304,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/sirens-treasures.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/sirens-treasures.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\netag: \"dhcved06u9zhiia\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jL2snmihbNdbYxVLoUhBaI%2Bwz2SaFig9kvretxIAopUq9UrTBFQ3z0OMsPW14ps%2BkTo6%2FBDAAWYVWiXbfhdpMglHGPspsRp2yW%2FkoqhXN%2Ftys6HFQaQLuEzCyhSQ3w%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a9176d3cb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23986,"size_decoded":24997,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"65c5a23c71ae011ef2fd59276b8065e4","sha1":"4ba9c84a9b4493f99fdbfa8dbd6c5aa59a39a883","sha256":"8bc5a609eef03d2586d5b4d3f56fbf7c083b9d7a9259286118903eaae921a050","sha512":"ae08fdba658b541325a026a29935c587fc49894f6465121c873c6f5a6b96148bcd999f91afd04e8863c1d00bdf1acdf9b2c3379bf68a81a89f61db91084bbd17","ssdeep":"384:NyIu5QGT/hgd52CpVQhh+b6SUPhaODm/Bc8pua2Gmc+LZbOl2KK5LKl5wdgDh2oR:YIEQ+ZgT2oQfsU8OK/5sL15QwdgDhTgi","tlshash":"b6b2f11fcb3a8611c97c30e1151ab17e52e54f5a3489fdab487c2ed0e75480206dbbb4","first_seen":"2026-07-22T10:11:44.579177Z","last_seen":"2026-07-28T16:30:51.600142Z","times_seen":3,"resource_available":false,"data":null}},"time_used":394,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":338,"receive":56,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/ajax/game/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:19.962Z","timestamp":1784715079962,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"POST /ajax/game/ HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 114\r\nOrigin: https://rainbett.fr\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":114,"data":"{\"exclude\":[\"2203\",\"1878\",\"2004\",\"731\",\"852\",\"1395\",\"718\",\"1424\",\"751\",\"2084\",\"1434\",\"1551\",\"2180\",\"2446\",\"1033\"]}"}},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, must-revalidate, private\r\ncache-status: Souin; fwd=bypass; detail=UNSUPPORTED-METHOD\r\ncontent-type: application/json\r\ndate: Wed, 22 Jul 2026 10:11:20 GMT\r\nexpires: Wed, 22 Jul 2026 10:11:20 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1BeX1HnJRINhr0v0DYFOvNF3iW%2FK8dzm3RXQpBTDe2%2BiK7ZK1KBpaQVfPnG5KCC1axlHhfuMydbNj6vZakD73hPj0mLGcbWMTndNUrDLL4rmtHKiRJ1eQzA2kr3B1g%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a921bd88b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":80,"size_decoded":1025,"mime_type":"application/json","magic":"JSON text data","md5":"d1bfb10d6c210654cf34667c68cfd5d0","sha1":"dae1de08c91221d4e78444b268d0b4d941daa754","sha256":"9a259c308fae5e513bef8b944b079c067f6009401e9b66d8d387fc7845d9b103","sha512":"8bb731a3b90fd55790a700731a2ff172df3df035a34837ad26e7e237b2f1cd374b964641a42875f1e90525ab990a29a68ccd849ff8f08772876fe6f1d706146f","ssdeep":"","tlshash":"bba022cbc802f80a033b0c0088ab30c0f03c8f0380a288a02bc0cc800bfc0232023c88","first_seen":"2026-07-22T10:11:44.580058Z","last_seen":"2026-07-22T10:11:44.580058Z","times_seen":1,"resource_available":false,"data":null}},"time_used":311,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":311,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/deciduouswoulds.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.417Z","timestamp":1784715085417,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/deciduouswoulds.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/deciduouswoulds.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\netag: \"dhcvecnya20i6db\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:41 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qrjW3PNXyuvevq2Q0u9t%2B1aGPmKhNvxprrsqrptZLSLjazag17zjRn%2BuKtIYO4L%2BWs1TvuyovhDQjylIZbc1bGP1vTzGwKQ7UREX9pqdEtIYXYXUac%2BCRH5ZzLEKjQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a943df00b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8255,"size_decoded":9265,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"66cb17ef5407c491c4748e82b0580d84","sha1":"96f2ca7a467a1dced7156faca337e77adebf0652","sha256":"4b9745b8339edd7d9f414ca9044880c234dbc9d71ef58f1ace554d43a93361b1","sha512":"50dd4a5e98f28401be31477e47020621cd5d68f7dbca11e62fbd6e60cf3eba4736ccdac42c72c61ad8940ba007b73dc587c98e36db41115fe2cd45dcabd52d3b","ssdeep":"192:/wazhHlFR2eJQgwOl254iuak9PtV0qsKy:/VDQgwQA4if+V2qsKy","tlshash":"bf029d958af06653de2f30707a81a114572b3f0321781e8b2fad27aecf1aa7a5c40718","first_seen":"2026-07-22T10:05:30.577155Z","last_seen":"2026-07-22T10:36:34.512702Z","times_seen":4,"resource_available":false,"data":null}},"time_used":167,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":165,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-22T10:11:10.042Z","timestamp":1784715070042,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nage: 2415\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=3600, must-revalidate, public\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/\r\npriority: u=0,i\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-digest: en7fa62f56fc7f645f99bb9f2dbd737fda\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GQEqE6Af9rGkOKQq%2BVbLX%2FElZn1Noy66neugtwDMmH%2BZ1PFCJ%2Fv4%2FgLe6mCDjrDpLtTTmLeWaR6mLFxH%2B3P5v1FlNXhZxmGom8GyhA8W%2BRX4gMvNQtdfumfrhpHc7Q%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e3ebbbb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":183829,"size_decoded":36614,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2920)","md5":"647711b189aab7e28bedb323a615411c","sha1":"ec75e9c1353de24c0d3d37df50dd6562971e76a6","sha256":"8035d2902d27ede41073cd1f0bfd8c7c7619a26c7f677eadfbcb6690af778048","sha512":"6ceb0f19b38f85b05f79ad47ec8188c439ecd51d80c843075fda8e9472b4b384d8ecf72f3ff9f0a3212a26d4919d410b3149c93c0a409479c8aa3915de4dd373","ssdeep":"3072:foEtw4GgotYVgjARXk1N5LcKcEvjmYzNbYweQEIU:f85tq0ARU1vIKcqj3xbYweJIU","tlshash":"7504d5ad67f411a740c3c3c27f226b673ea9e657c6168604f2ed4b841fd2c28d96369c","first_seen":"2026-07-22T10:11:44.581505Z","last_seen":"2026-07-22T10:11:44.581505Z","times_seen":1,"resource_available":true,"data":null}},"time_used":553,"timings":{"blocked":-1,"dns":3,"connect":24,"send":0,"wait":452,"receive":74,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/batman.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.396Z","timestamp":1784715085396,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/batman.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/batman.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\netag: \"dhcvecr6yvdakm2\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nkCRzObOBZ8G9aNFUGfQeo%2FiX9NS%2FOp7CF5Wqd8uPo9H1QGML2DsBfGtB8U9qK8CiwRKIIEdshT3u7Y8KmgIqTqAsJQG6DM9oxHehG1C3rmW8f84%2BVzUr3kEOpoJDQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a943bef2b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26714,"size_decoded":27711,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"ab1669abfff3f66e53676b0601a19dc0","sha1":"6fa0c79c0f6c84b4df9fd67f16d0aa499348cff2","sha256":"38681c61cb33c461e47148a1761514b52790cdebf36aad0ccba9af37cebf9c00","sha512":"139ec8efe2b77c9efd3bbe9361508218a77cd8aec7be2f307502954d527afc6f3cc4b9be327edfa17b5f5a893301550b44b03abb25ab3248a7409af72e3836f9","ssdeep":"768:ppk+NuJr73W93dAgEDkH+xEiBOHQ6Z3KUeQ0O8U:pSyuJr7EGLDkexEiMHQeMtU","tlshash":"45c2d09327ebc836e9fcb72c41060ce8927d975f5282da6dd8ddf645272d80d9a600b3","first_seen":"2026-06-19T02:29:17.569997Z","last_seen":"2026-07-22T10:11:44.582461Z","times_seen":2,"resource_available":false,"data":null}},"time_used":466,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":406,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/lost-island.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.434Z","timestamp":1784715092434,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/lost-island.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/lost-island.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\netag: \"dhcvecxvhp0nlng\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4ej1Tzy%2FOioQeN%2FQOhAk4xibK2AJV2Ma3uppSZ5u9hN%2BleIEmYAHE%2FwR8RoOBNdRfYkzy0VpEG3jBjyd8xxPdclqMzllpI94MWq8VniOpWWR2sqchXw2ZwVFx%2BOftw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a96fb85ab4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28060,"size_decoded":29066,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"9bb063f93c20beb885e1178806e5256c","sha1":"9ce35e7e94a08aa8ae50b7ba6bb3e235eb909085","sha256":"e3040cdc3508c17fefbd1924c4375f82caf02418f86feaeffd2ea7a07af8ca09","sha512":"3a8241d62cbfb592dc9438f20ccfec671ff2f15f1b0cf06e0c94df15159ed891b0376857807a22793c66af3965c9784d65bd63375757cad15e152a248b149886","ssdeep":"384:RWcTwC6cbO490vP9wpUzQNkCAMP4QIZn07z73BPX0T0Nt8H9evLpXMVZ5rNOWu1N:LK9ReAMAQI903BfGet8oG5OW4scv7","tlshash":"d4c2e1b017444202c83ecc7573cb69fa749785167b5dea6b608dbbc6b3fb80248b0699","first_seen":"2026-06-11T03:08:59.287727Z","last_seen":"2026-07-22T10:11:44.583479Z","times_seen":3,"resource_available":false,"data":null}},"time_used":370,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":311,"receive":59,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/autocratic.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.826Z","timestamp":1784715070826,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/autocratic.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/autocratic.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecnf87i96xn\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:41 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ai45gTp7AVCMc0ka%2FebXtz0CccjZWD5FFWUHzTG6%2BYQAnd6%2FGm5M11Xhhn30CKRo%2BpZW1b8%2FdkfwJK%2FCc124SHFLqdelI6Llss1J%2BnPwTudBvjH%2FpTG9I3XtUCnW%2Bg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e8abf3b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8987,"size_decoded":10011,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"3b7ffb0d767f53101c6b099c8fe985b8","sha1":"226fd8553d75ebad3163ee684db44951bf2daac1","sha256":"26be07c6635c5c40045befad7a9ab2a0290d9e5d148c83ebdf5a6174feedea93","sha512":"bce9336f0a113d3d7544293eb1c2554bb2a3d103a3a0ebd6c4b12cce4c9e6a65eb538a28674d808ffff8f3b169b74bed40e9b515103385c7d4d5ede4459c71a7","ssdeep":"192:WFhA0kcbaLhkeJ3KP+QwTAR6WArHoWj1c6zAmH:9Q0AQbHoW5n","tlshash":"9502ae779e572e3aecbd41725c9c10833e479d792e213a976f0e0e5c232904cc96ed29","first_seen":"2026-04-03T21:46:18.193774Z","last_seen":"2026-07-22T10:11:44.584011Z","times_seen":3,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-1.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.840Z","timestamp":1784715070840,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-1.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-1.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehjdsh1517d-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lbyxlZJY%2Bzbl00AQa5hfwpEO9ZxC5aQIceUJjXzElW2%2Fwy%2BFOP9%2Bpwgm1zEYJY4dJF100tjmkSVvAo01UkKFWRHPkXGxxsIp5XCx8xpMv3OD6NWTH2u0LkULDhlPlQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8bc00b4f7-OSL\r\ncontent-length: 619\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1561,"size_decoded":1645,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8de41f5da8783028edddb1f521f0398d","sha1":"78b41d70d90a89940298e7b3b65a8fdff911fa9f","sha256":"f3018c6592ef85c6177eaf5368ee29a093e8e755e025061c7ee22555f329b0b9","sha512":"d11bbb2f2f9445bf5df0ceb5d5da933637472f9c1681f4156155f586a50e092d71b65a396ee923028f97c8143daa3005b345fa796f68408cb7fb43c0f4a9d705","ssdeep":"","tlshash":"2731a7eec0d1a2c064b973fc8c3176e4654b3c7a6eb7d3764447d1a27e240988c0d959","first_seen":"2025-09-23T10:56:20.40165Z","last_seen":"2026-08-09T10:37:17.32793Z","times_seen":81,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-4.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.844Z","timestamp":1784715070844,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-4.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-4.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehk6d8si19b-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N0Q9wypxpklYSXG5dIX7QiORmxUwWuAqRh27gsyoe1oNGwKHaOOjLu1ckl2Rmg43UmnCIM5eDmcCouQNn5l54OzdpHXG68A5TsJ4h%2FfJfe64YB4S3Dg7VIb4HJYJlQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8cc03b4f7-OSL\r\ncontent-length: 760\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1631,"size_decoded":1780,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6c0d00c1a0b62e6e96a22de2fff89967","sha1":"753515c4ffd89eaf7ff41f11248f995bae2a5591","sha256":"d648926634c01101e834df3c9a37578267bfcf3baec1596b26bbf26f80d3947e","sha512":"5a6fe9b7f97f5e60971bba64e89763906658b881f4d83193463d763707754f60857ade205f0e47da391c84b4055fe987248a1b18e2d53235148308828b1e521e","ssdeep":"","tlshash":"593114f563cc71f0cb47e771d82f10a37f7220ba234deb5a63d81dc2662616d8189980","first_seen":"2025-09-23T10:56:20.432683Z","last_seen":"2026-08-09T10:37:17.270998Z","times_seen":81,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-11.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.851Z","timestamp":1784715070851,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-11.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-11.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehjijxnqi6-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qQnap25sejwVmPPz4IfGZzDVZHtos8N50hicd8TC6TTr%2FiIh8P%2BkEXBXRJ80jYBkV4%2FcfeghWIjRVSMhQ4ztz%2FaHIDmh%2FQvh%2BwgmuXu3DpxtpDVW1eeTXDf5J5HPug%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8cc0cb4f7-OSL\r\ncontent-length: 345\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":654,"size_decoded":1375,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4327c132d11b1333209b3374fa394f0f","sha1":"3801506e26c63c9927b3d9c51c342c6c3c21ddfa","sha256":"6001367bab33ec48507ae4dae10ad400329cfd0573a810ca4ec152139b49079d","sha512":"07bff970dfe38ebec44266f3903c23d82550da0777e8a774a852af6e87b0763ca43efa19f04fff5abe1fbd88a5c4862b6dda2c8296ff0a967722520d71520e7d","ssdeep":"","tlshash":"56f099da76f4a40a8a1443819117b2412373e1bc06acc898f294f3f8ba0ce8a5e806cc","first_seen":"2025-09-23T10:56:20.387521Z","last_seen":"2026-08-09T10:37:17.272406Z","times_seen":81,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/50s-pinup-hd.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.448Z","timestamp":1784715092448,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/50s-pinup-hd.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/50s-pinup-hd.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\netag: \"dhcvecq9mmzceyz\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n72lZr3CitQbqhS3PbrMFI3F3gy7cmy0rKcc8Jmmt8juZemCDPz%2BLyq5pIt9fB%2FGP6Njprk4O5ZRcfUeJzG5RFq1lKKAY8dZO3TOGsEj8LE%2Bf4z0YqPakj3sotTFwg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a96fc85db4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19403,"size_decoded":20406,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"180fa79214ea546685054c1b75e44bc6","sha1":"01e00ea9472ac87d5db6e44ce5afb13474b31731","sha256":"983550833f005497f83e862f6e367e8be76894c15049bbd359ffa26f08b63055","sha512":"3c5019f01b54cd1112d9471dfa96146f5e6435beb79b027a642a7cab146d1735497f8469d64c491e438fb0e9c5092a22b103af0bc023fb2be8ea3b6713c8bf31","ssdeep":"384:JJvpJP9QIK2UoKAuUyYBX8a9P+AlA4+LOyRL:Ppd9lK2UdUnx9Pdm4+66L","tlshash":"a492c06689385b04fc4f09f05d9f24cb80185d558782fa8bf1a9ac1acb2617d71e1cfd","first_seen":"2026-06-11T03:08:59.169579Z","last_seen":"2026-07-22T10:11:44.586628Z","times_seen":5,"resource_available":false,"data":null}},"time_used":361,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":339,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/hi-lo.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.451Z","timestamp":1784715092451,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/hi-lo.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/hi-lo.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\netag: \"dhcvecwvrqbfbxf\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1YuHmDuySo5h7vGuJpN60UdoLxYggDUeKSxMUK2nofdq2r8iIuvzWM3Dy9RdPk5JmK%2B1PLo040NiFJmzvUZTifi3i%2F%2B6Hr3aBvXB59%2FOnr4w7E9bZvEU5JDvCv9NqQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a96fc85eb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15459,"size_decoded":16457,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"ecd0537690adb976810410704fb590e4","sha1":"f6349d2c012ea7ee4278d17bbb1f6bb85f9a47d2","sha256":"a31aa16aa7e6fbcbda6638de07d9d15c7263f1b0a2ff254f8f2c075fe7b0cefe","sha512":"d002d72aa3553da5ddb008aba815dfe5af1c1148a149e4a3f4db4d6943881f43e74cef32b066bd263de331bf356b691d7b68fe96e7fc7d991d1edd20ff56e634","ssdeep":"384:MyHR3C6/Doj1svJhApDqiSMKi+TVbHIZgC13I/:MyHRdOsvJhA5qifH++gC1M","tlshash":"3d62d02b96911414f92c7b7e878c09631748c36974af26433da7554c13af3214eeb8d1","first_seen":"2025-11-01T04:33:33.205064Z","last_seen":"2026-07-22T10:36:34.576676Z","times_seen":4,"resource_available":false,"data":null}},"time_used":352,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":335,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/2.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.862Z","timestamp":1784715070862,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/2.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/2.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehj910ek17d-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pqKPQvg5384YzjDtnPx0HvU31ruFo75seu%2FPrK7e9MsRiqZdcMtvh8aWq7s42H1vQo3PGo20XuH13DjV8iOqm7ATo5q06N0OfQILlxDdJNnukH%2Fa5adUsHVlr0RnRg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8ec16b4f7-OSL\r\ncontent-length: 619\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1561,"size_decoded":1630,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9e41e20e700892cc6d4b8e82d54ac6dd","sha1":"c5b8d3a924398604fcbf0794b80132523bb88e2d","sha256":"1c83779a48702993568c1ec0f6c793828ae6fed8406550dcc1cc775b64b61c4c","sha512":"f95428239ba76e9b3cd3646b2bf65c0c90bb4454b173e53e45847d32dc824de686d41780e9a1ad12ed2fa045ee36ee1000c8fb8eea4d0c93b1b802f198675d1c","ssdeep":"","tlshash":"7831a4eec0d1e2c064b973fc8c3076e4658b3cba6eb7d3764447d2a27e240988c0d999","first_seen":"2025-09-23T10:56:20.454005Z","last_seen":"2026-08-09T10:37:17.300434Z","times_seen":93,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/attack-on-retro.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.401Z","timestamp":1784715078401,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/attack-on-retro.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/attack-on-retro.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\netag: \"dhcvecqztofgolp\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h45D5BqHdsZCKsrndTEwWm0yARfTcDWgNhSUCYozWSgdM1fcTOIxdHmUMaZa%2BWEpNmbxrXcbg1WuPwGQIuHFJADfOexx6lXEUV2%2BDM%2B936kI5xERF%2Fwyeq8jbcLYqw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a917fd43b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31885,"size_decoded":32893,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"3b2ad3f143dcdf9e068a584f0e87f4d7","sha1":"7c743dddc4b581334b0ceae895c775109a4ec860","sha256":"9cc798114903af8c9707f3a04467b276da4a0cad632396a0a7eeb9c7169225e8","sha512":"0c2a246957adf51500d25035b1c34ab6d7ddeb497a8c96092b42b47eee4d0d2b8f18c630904fafd2d534dab1d79e8b48d6a831a862884b6e922c73fe11424da0","ssdeep":"768:hDJom48ai0Lkrggt1Fnc8q4j6qYGmz6SYaexH+:h6moirrX5nM4j6JV6SYaSH+","tlshash":"8fe2e14f45d9d07eea0314f5683e0e77ab1dd94189c46a77820b212f2f592166eb0f72","first_seen":"2026-02-04T18:36:07.401854Z","last_seen":"2026-07-22T10:11:44.588725Z","times_seen":2,"resource_available":false,"data":null}},"time_used":409,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":343,"receive":66,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/ajax/game/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.962Z","timestamp":1784715085962,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"POST /ajax/game/ HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 114\r\nOrigin: https://rainbett.fr\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":114,"data":"{\"exclude\":[\"2203\",\"1878\",\"2004\",\"731\",\"852\",\"1395\",\"718\",\"1424\",\"751\",\"2084\",\"1434\",\"1551\",\"2180\",\"2446\",\"1033\"]}"}},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, must-revalidate, private\r\ncache-status: Souin; fwd=bypass; detail=UNSUPPORTED-METHOD\r\ncontent-type: application/json\r\ndate: Wed, 22 Jul 2026 10:11:26 GMT\r\nexpires: Wed, 22 Jul 2026 10:11:26 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WgGbccjiK0%2BBVqrpHA7Z0zHLe5YlXNGcUwo1uDlBAFFlUxVM4l7AoGVk0aoHT9TLPDnOFCKEMvjyzwvjGy08AdoyeeNnpnhzPr7JDJfjEdTrRHJMcuMyaXBopEtLCw%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a9473f17b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":86,"size_decoded":1028,"mime_type":"application/json","magic":"JSON text data","md5":"e84c4e4509911b12cc68db4d1109cc0f","sha1":"7fb1d89db934249588d8d9dfbab891fdabb8f207","sha256":"b652ab73d07e5d553c7d59aab52cd15d18dc545b8b94b3218f3300afb508f624","sha512":"43fd458eb36be4937d971755516441f35386b94e7c3bc571a5e736d08e22c3f0b037f5eb3ea0c24b82aa97475ad773ee004e080b33f5094829c87d1d7a699347","ssdeep":"","tlshash":"9ea012998001048a16732244081a34c0111c098341f1bce053485c8044a840100c2c04","first_seen":"2026-07-22T10:11:44.589606Z","last_seen":"2026-07-22T10:11:44.589606Z","times_seen":1,"resource_available":false,"data":null}},"time_used":313,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":313,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/build/frontend/runtime.js","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.784Z","timestamp":1784715070784,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /build/frontend/runtime.js HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/build/frontend/runtime.js\r\ncontent-encoding: br\r\ncontent-type: text/javascript; charset=utf-8\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvgua1hjsh1jl-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:58:57 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oxMlirGdFAdu60nbamR99go8Zm2aVqVNaPti6y%2FeQpovdLCrPWbbIX7RMTwE48C0HPf8fsnQ1jrSJX2YP%2BCUGhs8a49t4iGAVerEzDpC1ZNdERiDoNqKBh%2Fk6wGRpQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a8e86bd4b4f7-OSL\r\ncontent-length: 1016\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2001,"size_decoded":2060,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2001), with no line terminators","md5":"02e2fa878ad5ff0ec64aafc1deba788c","sha1":"2d33cf41828593bfe3b3c16b56b0336944549e26","sha256":"97a1575c74188c7ea756ad742df7f21f9d5c4d8ff6363f940c8ef0edd490efac","sha512":"10d01c41fffa766dd97a8f302b844d2ccb39bcbc3f21359026a2924e0aecb2a52f05e721c91afd312235492c26aba982995790478ee553d2a259e3ccfb614814","ssdeep":"","tlshash":"254196d722d8b4e663b84d4040ac8787f91e6536355de8a1eb91c9e1782c8b14ca7f34","first_seen":"2025-09-23T10:56:20.429759Z","last_seen":"2026-08-09T10:37:17.295316Z","times_seen":139,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/rainbow-riches.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.818Z","timestamp":1784715070818,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/rainbow-riches.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/rainbow-riches.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecz9i1lkt60\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=i9V2wDZIcrcbzqDU4YiSTM8n3%2Fztd9Bb%2Brnt3jpahjTZ8Yh1o9B%2FPuARnPJRv2eF7Ir4TKVb7HKJV%2F4d%2BF99PZbgtI6rUuGsANHXavmm9l7YWkrwxqX4MCdLfJ3Mzg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e89becb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":37800,"size_decoded":38818,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"c1b760cd1b5797e79d5c9fb14fd2178e","sha1":"e7e1e4d79d2a1d74eea2053290dfc09f11f614c7","sha256":"40187ae032b55090e75c3d5f6cbb53544feb6fe264ad2e5b36732d729b6dc625","sha512":"0b8492bfcee4f851a8b6a8c38495e7ef40e2d41bcf94fa26db108448bda537c5260d67c5b4294c3878f3e7831c12f4291b3267e22b39d6c1fab2f5e839fec828","ssdeep":"768:bRfkSOhDADdO+HWdJRNZfSXYPkJVsAPGUa4frM5Ajzw7LXi3Fc:1ZOhDA3HWdJVfSIkJAWg5AjALqFc","tlshash":"d703e1c9b12dd094f2bcb2fad26a153a410d1892370221b3ec07ce48a725de7d56ca6f","first_seen":"2026-07-21T03:17:02.654964Z","last_seen":"2026-07-22T10:36:34.653789Z","times_seen":5,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/yueh.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.822Z","timestamp":1784715070822,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/yueh.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/yueh.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecpxpzey6cs\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Mas6Z4x1dQGV0x88l7o8DUjg094kDQUb6h4tqI%2FdaRQuumJ6GP2N66M8xNTwn7L5YQAIFoeBTGOFTNL2LWeAkCAKoj7hTKqwuQ6taosZRwfPMJAn5x3enqCyXRNKbg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e89befb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8236,"size_decoded":9238,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"3090db2bf6f9d7dced73f6be7c3137ac","sha1":"7e39e9d1ea34b198d2c68d1becae5877c3d3ff22","sha256":"446c2396b2ecb4dec0cb7b3f5d0a7eb7e4bf9e8cd90460ab362707fa3b4fb126","sha512":"7172ede4d5e9a05e6f5683ce93746a194e36fcc9efe5ca0e1d6016c93fc8317f65c3d47bb655e910f932d70f47a2d9303181048158985bf19c1a847eb1825b24","ssdeep":"192:BjkujbFLILawMozApLLvTlwwW7h0pury/iHhyRnbD:BjkYmLAoEpqwCOShkbD","tlshash":"ee02af0533d0cc0eda9c3a73705e2d17f75e26040687fe39dac4642987994e9c49f3a8","first_seen":"2026-07-22T10:05:27.266312Z","last_seen":"2026-07-22T10:11:44.591961Z","times_seen":3,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/build/frontend/images/search.5e828e81.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:11.249Z","timestamp":1784715071249,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /build/frontend/images/search.5e828e81.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/build/frontend/app.css\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/build/frontend/images/search.5e828e81.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:11 GMT\r\netag: \"dhcvgu9wq35whf-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:58:57 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z6GVdUPh99dDSeWxnGRBhcXjzXSeZTyumfuOzRJFikT8tKmnsy3DbxOXPo5sOtQN%2FTUrzVagVKmZnfNTVKDtO%2B1oA9r4ScDdUBPRtTnyUy7HDenpTc%2BFHjiAe%2FxiXw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a1f1a8eb4c32b4f7-OSL\r\ncontent-length: 296\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":627,"size_decoded":1336,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cb40655e1c46dc85e1c6f5ff10ab4f1b","sha1":"4bc19332f42634d2f4a221db82e53c4f40fbfdfa","sha256":"02faa5971a2df82ce9308007cce207a3aad95919f160ba43986bba6e3266cb9b","sha512":"1c354b5eaf1ddb09092960cdb4d564abf7cf5d1051a9546ecf6c1e170c2d79e9e659cef8f23454549dc5d1ac0a733fd86af7f95d1d5d9d86985aa0214f80df55","ssdeep":"","tlshash":"a9f02de91344491cf0069f36ff057e7d8057787e7f8a1450c050907aad621de8922ad8","first_seen":"2025-09-23T10:56:20.272697Z","last_seen":"2026-08-09T10:37:17.29191Z","times_seen":116,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/giant-s-gold.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.453Z","timestamp":1784715092453,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/giant-s-gold.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/giant-s-gold.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\netag: \"dhcvecw7yf6mrat\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KPYKrhJEZzedCpFMbmfWKJj56iNZcYO8LtX%2B3OE9IDC1Nb44i37QXhTKMU1s5L%2Bpc3Tu9ovy63LVHod25jr0x%2BRkE9q8oyXhj8sxgxhBvSS5grokK9ByarVLB6j6uw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a96fc85fb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":35381,"size_decoded":36384,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"d5fce6fce2d08e7f6269148f61d63ba2","sha1":"6700c105b5cd22d31b790f8865644d7c8d0ced07","sha256":"12bfeec337792bb5adb2e08ade1791493b4e6299b23de3b4c4686327b7e73717","sha512":"522f9b7950c19eab956f411a932ef98148ef1efe1c75cb18f55ca5dc41b27db71efaccfa8d9f7ecbdd3de8c49e84e386e3ac92f8bec837ee7ed998a9f6e92f11","ssdeep":"768:PSQm19BExVxX8Lbt+TT7rh+7GmXB0HHMlLXv+SCKCnegrZ1rmcUv3+0ed0+b6+4F:qxuxVJgwhSGO+n+mSDCNmtWndNJ4o0","tlshash":"47f201dc373091369728b3feba1dc0e4aea46d951c7b676eb5a080701b394419d60faa","first_seen":"2026-07-22T10:11:44.593049Z","last_seen":"2026-07-22T10:11:44.593049Z","times_seen":1,"resource_available":false,"data":null}},"time_used":406,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":335,"receive":71,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-15.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.855Z","timestamp":1784715070855,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-15.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-15.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehjnbea916j-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d3e43aFtTc8g%2B3X9BYBhH%2BO9VFa5T7hJ4cegPbGliT2nO3y1xakgvKu3UK%2FLgrvtks3ju8wLYi5tqI3zygoADb43lGngkSrEqPadc3eYzNxcidj31lSZrlzrMA2xLg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8dc10b4f7-OSL\r\ncontent-length: 764\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1531,"size_decoded":1789,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2b5069c2e7041940a7e01910ade8c30d","sha1":"5765b729a0b250a82c050f4360ba1c9319b53eba","sha256":"81a7e9e0fa50af39a89f5c457c405559a4564822b7668378caa4e84422ecfa96","sha512":"2252ae727da9f4c3789c5cf3936af343c3a59f79f3f0150195a9c0145546e2e0585ac4d2fca574c9baf41ccca2bbaed03d27ff478131dd500d286f25e31ccf10","ssdeep":"","tlshash":"cc3179f82bc595d0d901c770891690b4195e38ffbdb5dbc8c29148e0ee500bd0d1d880","first_seen":"2025-09-23T10:56:20.391686Z","last_seen":"2026-08-09T10:37:17.277863Z","times_seen":81,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/build/frontend/images/bg1.71f9ad56.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:11.242Z","timestamp":1784715071242,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /build/frontend/images/bg1.71f9ad56.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/build/frontend/app.css\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/build/frontend/images/bg1.71f9ad56.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:11 GMT\r\netag: \"dhcvgu9wq35w71ns\"\r\nlast-modified: Thu, 26 Mar 2026 16:58:57 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=4,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CRN%2B9y9yiFw4clsRFDQs4NYddTdTHPrT%2FmMQI8iyxKlO6Xg%2FRg1wJVA%2FXn0LL96PjH%2F%2BDuyWfad6a8pNjnBxS9Lxu6rEBSpO5cZkg8FS1ElA1p2byZ3gklnnjh76sg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8eb3c2db4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":328744,"size_decoded":253223,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 2480x904, components 3","md5":"594334bc1e2981b09002ae1cb8eb013b","sha1":"e52a37c73abd80652b525ef3f91a0d2ee30f650a","sha256":"9529b1e09e85360421e87914b1e3eca49ebe44a119179f7c457fee66b0b6b280","sha512":"d0452a969ea133054f5f9014744931bb6ed97512845a3fcdaf21e93ee1ba9cc30b55682fcb2dcf5d617a80da82c582d5dd0bcfdfcefb29004b59417d71fb302a","ssdeep":"6144:u90ov0+V0Kt18VAPZddAbgSOAT3n48unRuAi:u9RvDt18VAxddIgSO23HU8b","tlshash":"6464d0a4ff9067414d5ebbb2e689b9168d1a0bcc59e98dcce4828c3df5e03c1cb27654","first_seen":"2025-09-23T10:56:20.412378Z","last_seen":"2026-08-07T10:24:40.762086Z","times_seen":21,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/great-adventure.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.454Z","timestamp":1784715092454,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/great-adventure.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/great-adventure.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\netag: \"dhcvecwm8t2bgka\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7Cng9CokD2wQZ2YmPkLyOk5CSQ%2FwxN1Xc2MOiyzr7FQJ6Yi6Vqd6iCNuSm3cscs%2FOsC5ArfTqS4EHQy7X0GmPVpsFFgZ7LeU73lnF0cxVmKTjKi2w3ifFnbhSqQQog%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a96fd860b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21466,"size_decoded":22470,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"1518ac17b02dbb2f6cb8696e7333cc7e","sha1":"26be1bab856d348ee924adbe08a196f883e0c178","sha256":"3e8f9a41372eb9f63310ea922395237be185b20ea29921e928af15b293e0af32","sha512":"99f3e597fb4e7c56cbc85f111b180b67a79dd6f2ca5950955a1fc91c0876d2e724ae4a265c33d4de6ab1349d4dcaf8791e70997c56b770aa54b77726c806dfc0","ssdeep":"384:EFvHRuTrV5S+B1ALzP1SiWLG3z0XWyXKmRf7SQF4IbbqikZFqG9UeE2mpXH:Axufa+BGLpp0G3z0XjlmUbuBgG9Ue4H","tlshash":"63a2e0509617ca9adddfd3d4925f4e707942eee03e472a6a9d0152d8efec432b2143d0","first_seen":"2026-07-22T10:11:44.595343Z","last_seen":"2026-07-30T12:09:04.725192Z","times_seen":2,"resource_available":false,"data":null}},"time_used":377,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":351,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-14.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.854Z","timestamp":1784715070854,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-14.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-14.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehjkxnyz2nr-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bajdi5q0NxabTtIA3f3BwxfNqhIuqqP%2Feeq6ZkYTKYAfpHZWftB7kpg7cR%2FwZtMz%2Bjkk8MbpfLJ0CkEnhhH6%2FV4nu4MqNu0Suji9Qpan41XR0pgkCwr2Eb8l84NzlQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8dc0fb4f7-OSL\r\ncontent-length: 1375\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3447,"size_decoded":2403,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8868f668d3136afdb9880eb4060f5a6b","sha1":"bdae8cf240610b282d1d9d6c68499736dc9ec8e7","sha256":"4ac5eb4fb1e8d08409ae5f4fe1b604b94bb02e1599f601e7c8905be30d5a48d4","sha512":"3e7582fa02e30cbf1fbd3a1da22ffdb54e0c9b98f95f41cdc757e2b5c0891cda3d5d444f90be6864a5d78550e7d0e096261ed38802e50fe1107bc2174fa62e3d","ssdeep":"","tlshash":"7d6134e94bc924e4a9458bf0e5229b327f5738bf7719c7d58210eaf4fb0545cd285860","first_seen":"2025-09-23T10:56:20.342454Z","last_seen":"2026-08-09T10:37:17.328749Z","times_seen":81,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/3.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.861Z","timestamp":1784715070861,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/3.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/3.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehj910ek11l-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FW9SDy8KUhqARzA5J1U6adBFEv9CDpG%2B4ygNvj880oPoY7cnh7ykIj7RD7OuIZt24WhLncuuZq5mLz5jr1pLbArxkCQNKzz0K9eGEI36rF6YIj9FDZgimX2RWdvO1w%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8dc15b4f7-OSL\r\ncontent-length: 691\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1353,"size_decoded":1700,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7cca30d934324d88cddd9876b5070785","sha1":"d867219049c7945dad6e981df487d16f0494a826","sha256":"83b991de4d7f807eb05532cc2da05df845425fb1f4937e8599a951c612dab690","sha512":"b794792d3223d4173c89a16993c89fc8e8b38179bf9efa7abba1e95719b22ad7ac65efc8ffb96dbffb62639f5ad08d849d190b894fd071f4f444252431772b63","ssdeep":"","tlshash":"282131a792dc91c4a40387f4ca1e34a1329e25fe1b6acbec53d0ae717c4916c854d9c6","first_seen":"2025-09-23T10:56:20.346607Z","last_seen":"2026-08-09T10:37:17.350937Z","times_seen":82,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/vampires-vs-wolves.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.411Z","timestamp":1784715078411,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/vampires-vs-wolves.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/vampires-vs-wolves.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\netag: \"dhcved1z50g2o58\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=m%2FSHZSFWbNfZeaO01cemRBwGopqiqFfyYEukq8CIA9x7MgFCsvV48Rj%2B9VzDdaX93U4RkzgVFr2aPRFubQJMRhORoH51fqMygAxZ6GWEcgKoHLTluRKdhUsyEKot%2Bg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a9180d49b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31292,"size_decoded":32301,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"df53d4f3b10f7d6eb0d21a35623c3f20","sha1":"23e4799178cd66f0d18f3ac5a0673b0491e60996","sha256":"72ac9f5b44d8de77fab4ee87960e6523f0cc113a2343f4a4df28ab8e8db7c249","sha512":"c0712348eb22a00ac6d9e899c7863ef64574889a325c445ab10ef0d30d25162c8f1f35fb52b0f30eaaf6a4c7683a352f82af7764ad0e97c718bfa54d8dd31de1","ssdeep":"768:e7YW8lO3qIzvhvIWG4A7UP/ipZRj48GUUwOOkPA:e7YlAlzJvUwPapzj6UR","tlshash":"f7e2e167769864daf06c153b337832116b989eea7a21054227c7ecf02b95cc3f7b4166","first_seen":"2026-05-18T23:51:30.70345Z","last_seen":"2026-08-09T10:37:17.343147Z","times_seen":6,"resource_available":false,"data":null}},"time_used":442,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":379,"receive":63,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/buggy-bonus.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.407Z","timestamp":1784715085407,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/buggy-bonus.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/buggy-bonus.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\netag: \"dhcvecs4b3r7upv\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EpSsVLzjyBghaxzHKwyb2Jc8%2BbNXUADW2kBT7J%2Bm6%2FP9UXZ3bcZFdj2G6mRxt1XmdSm8yxWGGkv4jwwMCb9%2FZ2Wf6ThIKdnY27eXtHRTU1mH8IB0S8JZiERuM6atIA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a943cefcb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39811,"size_decoded":40815,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"4d8e2fa518ba16fc900f224df66f7a73","sha1":"c7af21d29572e0801722b28f796e5c05ad3af1aa","sha256":"b1b5d82aa8466feb08ca7d2395e10d33920939646717d48d09075f48f040590a","sha512":"3ae0e56f604a63eb5b2ed7c047dab6f942ffb14da0feb977529d4cb36018dd1c3de67d1c34530cbce6a942afe9c16cf8e0a9fd26a551b370e5e790ad86010332","ssdeep":"768:hjHTGTNrJb39MozwWTSaeNBHLBiD1+8wkhPU4fta:9HiBlT9MozwWmaaBEdhtfta","tlshash":"ba03f1c5d1d9e575ec5cf0325e170185abe78e215abc3891f4e032b207a5ae0fa362b6","first_seen":"2026-03-16T14:22:50.875535Z","last_seen":"2026-07-22T10:11:44.598533Z","times_seen":3,"resource_available":false,"data":null}},"time_used":495,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":419,"receive":76,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/football-girls.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.408Z","timestamp":1784715085408,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/football-girls.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/football-girls.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\netag: \"dhcvecvhrdqkmeg\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8qbpKJf3Y5U2xdcuyNqPVsIv09KVHUPxy4uwXUFApJYi8Fc2nUmQ01IvL0excmaG45gUadY2Ah4qmvpJhkGFy5J744x7sKv15JIZdGcSi75vARsmlCLaa8xk4C9m2w%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a943cefdb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29032,"size_decoded":30031,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"cf807c39a2c4e5dbadff379f75685724","sha1":"96f0322d8d9b2c0e6d49a38c535ed9c7f3ea6e1f","sha256":"145250d749e31c1176bca9e819202cdf925497a6b7af778ae5b94b31d206f201","sha512":"5373ffced57a56b5c0129ef8794bef01c7d7850547d4c7bd8956c608781948318fd471a510531f40e0489c81c5ae3aedb40d9a6a70cd856531700bf164137f39","ssdeep":"768:9V0QYEywcp0eE/0NH/n1hYBLEO4NqZ0eJYCxKpeWRwgQ5iknp31fX:9V0UZcp030NHP34YqZ0QnUpnQxX","tlshash":"aed2e0a2a428e21ed05d1732d5b7834451d28ae737006de92cacdd7093ed5d236efaca","first_seen":"2026-06-02T00:44:56.605063Z","last_seen":"2026-07-30T12:09:04.759518Z","times_seen":3,"resource_available":false,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":129,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/newton.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.832Z","timestamp":1784715070832,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/newton.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/newton.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecp0dr1043b\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=unVfzrm%2B5RHsq4CvYeXXREwwbObSCmW6N6PdS9TSMKC1cR0Z%2BM55Cgc2qcsKviGb%2BrsbXwVPDliNCucmoRWLP37zEvxt3YStOjmJMPsVoH5Ssh95QIs%2Fh0pLPXeIXg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e8abfab4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5303,"size_decoded":6313,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"6f50291c45972e13187f1c0b9703497e","sha1":"fe654d29bbcea199d712e965ea6bb119fa118c8b","sha256":"68e73f74a70dc7b49262d4626775a7d8e0564aef95c6c1fe64d3c099cfe8b6a5","sha512":"84b8c7fcbe3af4e1471fff034dcf461ea5c66e9d4e6f3acc6b16f6d82a2e0f770beebb5cd07d9689f2344aea7e4a356611efcb00e5af528171cde816ba611fca","ssdeep":"96:0Mj1Givk303ACitWSZLdUS13n3KRI5tYBdffWq/t7bcohZPIU730pYZg1:0uG73nrZLdUS1HKRYEZJ17bcETL0pYW1","tlshash":"18b19d5a0b218d61f42e47bba61dc9c63b3468d0adbbb126bfc0476c5f3615a2c2811e","first_seen":"2026-03-03T13:50:30.58162Z","last_seen":"2026-07-22T10:11:44.600924Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/blackjack-classic-40.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.393Z","timestamp":1784715085393,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/blackjack-classic-40.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/blackjack-classic-40.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\netag: \"dhcvecrl998yezz\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hpBEpNhF8Qd5tVmfHtr8ZYS5%2ByeblVALkM%2B8AibVsTXJB44A3SnNmT%2B37olGfpzP1T3dac0zNMqMDyT%2BtBHeGuHqAnSpDY5k5eVnTecyw0OSVyU6B3kvY5jCuuDWKA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a943bef1b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19439,"size_decoded":20452,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"e352ee987fb519ab2301529ae35351a3","sha1":"42e28dc77918ba90fc428fe88122d5bf21294ae9","sha256":"c75bbcc50acdc2a3db09bd1a0c977820d9eff4214e4b4bd51a5438e86ab788ca","sha512":"740fbc6f440de8a6027f7ee004ddb255e566def6098806059a1674c73e91051d363dda5e01f3db8f004f35c7cd976e462960b67215597a676e3ed72b91dbf037","ssdeep":"384:X6flZHgSM2WOa2Wv6w8zk7leGvLcuc/Q25YYezIrXLOgVb7dGCc3kT:qflZHg8TzMe+czbez7W7OkT","tlshash":"3292d05a29f60764f84ce0ba1cd2d8e6b523dd9725869f993cc2b71d670d088a8013e7","first_seen":"2025-09-23T10:56:20.325976Z","last_seen":"2026-08-07T10:24:40.771014Z","times_seen":59,"resource_available":false,"data":null}},"time_used":382,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":361,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/play_icon.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.802Z","timestamp":1784715070802,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/play_icon.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/play_icon.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehnf2259gw-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tsxHVJgEGr9KbZes0Q8fNrV%2FpwqY1YKWHkHMzouIm8ljdzbsDaqY%2F%2BadS9s4h%2BI6iH2ail6uuMUAXCXpO5f7K4wG8UP5OKrwyzX0Yb1AJ2980%2F2Otj0YERcwpifhTQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e87bdfb4f7-OSL\r\ncontent-length: 317\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":608,"size_decoded":1335,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a94e7b7d682e6965e90fd1c8c1e26588","sha1":"92bdeef1467d74e4c07e379d7854938d7e452331","sha256":"9b6fdbc7ba3ac3786f4ef6dbffcdabb777c75c65fba811a71d63e9687abe49a2","sha512":"1e7e06a15abd8bb77e04f29b5f6e9d253812858da1b15eae10fc88458cce7452273421c57b3885b9c33f847b5a8228d09c525adff1ac455fe66b9d8fed19d5d1","ssdeep":"","tlshash":"7af0ac96a3fc32d4e1809fe134e1242134ef28e73445cd26dee86a05eaf71cc58d8514","first_seen":"2025-09-23T10:56:20.464745Z","last_seen":"2026-08-09T10:37:17.170798Z","times_seen":47,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-9.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.849Z","timestamp":1784715070849,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-9.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-9.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehkn1czh16g-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KCF7HTQevfDCqCM8xCV%2Br67sE%2F3XocVMP8I61Zjw3hbnzCFmDenoY7%2F7fbTtxw%2F65kzbOV73yuKIAnHI9aJ3dyjBq%2Bo6qxG5K1CdbKnDO9y64V%2BReMmiv6qIifyvyw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8cc0ab4f7-OSL\r\ncontent-length: 534\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1528,"size_decoded":1564,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5b102749c281526507c5490e83fdd185","sha1":"a454c193891fa7a94fb760360ebc1fa01dec3cbf","sha256":"3e2a708374909f4afed3afc345369af514c01e6fa6c9e8db3a40660971a82e92","sha512":"4178d3b1d6077876db67c432cef840fe113f0784fcc6df57b067dd71389307306a807ae0262e958fa5a8c625d1ddbbadec7d54a045faae16236deca33cdaade1","ssdeep":"","tlshash":"133166e582d5b2c19059bbe8ce39feb239463c375e73d726c1a62a717a00058cc0e8a1","first_seen":"2025-09-23T10:56:20.486839Z","last_seen":"2026-08-09T10:37:17.261605Z","times_seen":81,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/ajax/game/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:13.958Z","timestamp":1784715073958,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"POST /ajax/game/ HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 114\r\nOrigin: https://rainbett.fr\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":114,"data":"{\"exclude\":[\"2203\",\"1878\",\"2004\",\"731\",\"852\",\"1395\",\"718\",\"1424\",\"751\",\"2084\",\"1434\",\"1551\",\"2180\",\"2446\",\"1033\"]}"}},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, must-revalidate, private\r\ncache-status: Souin; fwd=bypass; detail=UNSUPPORTED-METHOD\r\ncontent-type: application/json\r\ndate: Wed, 22 Jul 2026 10:11:14 GMT\r\nexpires: Wed, 22 Jul 2026 10:11:14 GMT\r\nserver: cloudflare\r\nset-cookie: geo_country=us; expires=Sat, 22 Aug 2026 10:11:14 GMT; Max-Age=2678400; path=/; samesite=lax\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GQAmipcnHO7tk%2BpacxhIHEHvjpcULbCYygHgQqzOieU67DHlSIzxyge6tD017BRgJ1XsMcamPzGTuLSXMGkt%2FyVDM7mIrq7w709UwVcCkThHNo%2BL3fVleGPXKYUG8w%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a8fc3cacb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":88,"size_decoded":1136,"mime_type":"application/json","magic":"JSON text data","md5":"234048c368a3828c7e52df4cc2e4f6b1","sha1":"0a3404adada543ec51f1f53edf17e3e9331f91cc","sha256":"81b72fcb917004a45fe2fab6958aa2e5c4015fbe04bebe681a15695001e806e4","sha512":"87520ca6b6444648f24283df6c4766d9c620443254e62efa4faaf6f0f9df5974a93979956da51bceed13e008ff3bd1db8bbc77c373f9cfb98ea49b3e61430bbd","ssdeep":"","tlshash":"83b024f540007c050373c1c1140f30c353544f0304d41c70d340cd430511f077043c14","first_seen":"2026-07-22T10:11:44.603155Z","last_seen":"2026-07-22T10:11:44.603155Z","times_seen":1,"resource_available":false,"data":null}},"time_used":628,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":628,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/platoon.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.405Z","timestamp":1784715085405,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/platoon.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/platoon.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\netag: \"dhcvecz2cunpkub\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lKAf2oe9kUFJTLAPfNU604CVCyb9rLUXh30vEI0d%2BOt2RpYUPteDhqsaIDiIjKEi1h2FzK5DdPZhRpxjaf%2Bz6qDnvde7UO26GHEKFmsU8y7ABz6g8miNyr%2BMpM2wxw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a943cefab4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27011,"size_decoded":28009,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"1052ac437db8d29394299ac8e973e125","sha1":"d2807680b03c1089e7007206f7c5393761aaccc4","sha256":"f212ce32f66756d2abf8757c5509e2c84b468339ae314e45170fbe03038f1f1b","sha512":"701d820ea048cb47d1b04082ba5eb43e8fe755b77b5fcdba86db71108a13b71b0f0da04a17056db2e59d5da69b80ad303b1b89aceb084545ee571fd90db20d45","ssdeep":"768:2hyk4mIMbeJjX/EZLF8OyY/0bfxmIBljDdt6EyR09:oyyBbo7mFxyY/cM8liEz9","tlshash":"3bc2d0521397c4f0f2ddc276a0d1f390c26aacd6617793830df8a691b3746f0a9925d9","first_seen":"2026-02-04T18:36:07.345504Z","last_seen":"2026-07-28T16:30:26.500249Z","times_seen":5,"resource_available":false,"data":null}},"time_used":436,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":374,"receive":62,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/vegas-magic.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.411Z","timestamp":1784715085411,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/vegas-magic.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/vegas-magic.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\netag: \"dhcved1z50g2rit\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JKidIdKpUJHSt4PMb7mEvRnqqQV8%2FhDcCjDy%2Fdixt%2FDG8fCkVqkReiVqiK3VNW5fjw1R9xC8mJ%2FRgGR0UmNAji9Dl8EiiBybGFlhz9bJcqnfsj9WuKCKp%2FAczucqNw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a943cefeb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":35669,"size_decoded":36675,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"b84b0cb8f6e0daf01b9b43a9abc0e26e","sha1":"660c8aa91fd550a39c53a0235abf3b8cb8dc3252","sha256":"614be5bba28681056933d5697010a9383504884123b5cd8d443ef73c4fd5174f","sha512":"234cee8d3c32e56d89e14684a84f5606f01e171f915b353ccb26aa6a56a87857c3140911e5c8afb8db0ec9a0c3957799542799e4970742c0c0839d2b521a55e8","ssdeep":"768:eD9PLFn84EUeljk8AUasmOd6/1cpkje2MSdYWqD8Tas:I1d84E1jpAU8KcNMSdYJg","tlshash":"99f2e107e9dc674ed97e5916bc70b5d366c4af4aea004c023c5e86584f2f17bd2452b4","first_seen":"2026-04-03T21:46:18.205313Z","last_seen":"2026-07-22T10:11:44.60534Z","times_seen":4,"resource_available":false,"data":null}},"time_used":214,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":42,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/vicky-ventura.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:27.281Z","timestamp":1784715087281,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/vicky-ventura.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/vicky-ventura.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:27 GMT\r\netag: \"dhcved1z50g2iyf\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F3G266GPwlsJ4n2RYlTvTs174MtNsbKzcaHGBPmVZsnXuzjQekQp5fMPk6vXixFJPDYWdrvEHp8Od3064cj7HgTXV7%2F29uXj1%2F%2FhNE3fSG9CsQpBBFhUFrbWfl8gQQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a94f7f4eb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24567,"size_decoded":25573,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"6d06a1d5ff5ee1066311c62b583389fd","sha1":"85343f3d3fd7dc8945f615e546951aadb28947d2","sha256":"d7dda449d7467c14949202e97dfa6f0138fd49f420f10b2084ae8ced1805afa5","sha512":"1840ecb00ced1f3309110d55fe25677f812f5e4a4f3e41f9598332a940ce3cd76046d0095abb6896f6ca5c2a32d2c05489edc40984373036af952c4126ceb02f","ssdeep":"384:vSzDIwo11BX5btTctIVeCJoDvIHscVlQj8vnrZfiyX9x3XG2q0T/sQmB:KzDLolJCIygfs8vnrZfjzG96kP","tlshash":"86b2e1b85a22005bed6f7d7268a0a303eb5519f8c113770dd36c4aa2472e1634ede5eb","first_seen":"2026-06-24T10:21:13.001355Z","last_seen":"2026-07-22T22:37:23.797828Z","times_seen":4,"resource_available":false,"data":null}},"time_used":409,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":352,"receive":57,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/ajax/game/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:34.962Z","timestamp":1784715094962,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"POST /ajax/game/ HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 114\r\nOrigin: https://rainbett.fr\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":114,"data":"{\"exclude\":[\"2203\",\"1878\",\"2004\",\"731\",\"852\",\"1395\",\"718\",\"1424\",\"751\",\"2084\",\"1434\",\"1551\",\"2180\",\"2446\",\"1033\"]}"}},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, must-revalidate, private\r\ncache-status: Souin; fwd=bypass; detail=UNSUPPORTED-METHOD\r\ncontent-type: application/json\r\ndate: Wed, 22 Jul 2026 10:11:35 GMT\r\nexpires: Wed, 22 Jul 2026 10:11:35 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=t205gOb%2F2%2FWYdJYXG%2BcDQrjqCLzJmDv%2B45mmqPTJIqZ%2Fkn%2FcLdw2dhcseXCLcGH6oBEEEraewSqU7Q2KNSQ3cDeFKLe%2BFhDPL8Dx%2FWt%2FbUYuV9Ir7Lkvl8VeZCJt8A%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a97f78cfb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":94,"size_decoded":1046,"mime_type":"application/json","magic":"JSON text data","md5":"c5e15b89f9d39fe726a579bb915ce3b3","sha1":"0af7141cab0f464c4b179e7ce8975958e601191c","sha256":"6b311560a699f1b9b11d615b7b3a9dd45299b0aba7dc41cf59ca4d42a69a4fae","sha512":"27b42211ecc17a91eb3250f10b056682e36e423e2decfa87f7c071f5855a9785d3a8a1c26dd91ab40096fd5e6f77081a9c9e65d5df087ad6a5ce14f8e193bd44","ssdeep":"","tlshash":"4bb0129b80c80517413312c4250b318020780f03186434006e5d6b84049840d0143c40","first_seen":"2026-07-14T13:54:41.536577Z","last_seen":"2026-07-22T10:11:44.606526Z","times_seen":2,"resource_available":false,"data":null}},"time_used":332,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":332,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/football-carnival.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:36.317Z","timestamp":1784715096317,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /uploads/media/games/football-carnival.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T21:54:00.44177Z","times_seen":17861250,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/hot-sync.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.805Z","timestamp":1784715070805,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/hot-sync.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/hot-sync.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecx0j6y0h06\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8yu9K0SoVrxopUM1vuuoqd8RDLqRqc7t%2FaJr0np4bxWeGoE7Guh1y2Ta1yQz7ZJJ1CbZ81aYpqRpvYL7yJpyoJ439AJ67WuE1mMj3tmCnFAAwFJ1QBAYpFNSnOi29A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e88be1b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22038,"size_decoded":23042,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"70f40827b66f6c977d696fc36bf20eb2","sha1":"4eafbc1aaf694cf1f34185a3ddb2ed00f180c6a2","sha256":"89def03526e7749edafaff82dda14c84bcc53be4ef9bcda7281e595667b7539c","sha512":"43ac0c18223d9055b3f34d60f15756c31190640dbc87aa1d42f1bf78c6e0de62d8de254cd1eee12cc166edfe49998b478e3e02fd5f9115b06f34a77b7ec96e2b","ssdeep":"384:GQVRCFzG8T2735Q7J93xgOhb8Z3dtMBjXvcCEDO8IaRYoAhS5IJ/R2FBL8xtyQVx:qFX+3y7JJXhbWg9xWOWROfR2FBOjVx","tlshash":"2ba2d0c86ffd11b17d2a5d7d83ede13f87010916e06478971298142267f873b197a2b4","first_seen":"2026-02-10T18:41:07.180066Z","last_seen":"2026-07-22T22:37:23.666488Z","times_seen":5,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/ways-of-fortune.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.815Z","timestamp":1784715070815,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/ways-of-fortune.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/ways-of-fortune.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcved28nxp6lx0\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=l5zK6EdLxsnL1JwW8jXC0S5K2OTBCtDKISe7R2JmCbfG7xesoBOZq%2F7IoE0NF238faXIzTmWSUs3L%2B%2BsCsEwX0S2DUmOMAwLYmayJPgSSjh%2FodIJWovp8Emc6X1hYg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e89be9b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28404,"size_decoded":29421,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"2192c37c487e46dfd011bee2a5bea7d9","sha1":"a764b3e6ddfbbaad81c504ed55af8c4bd499ca9a","sha256":"9c242f3745a36b1cc101b790af6175becd721b94c1f78e2d0fe4ebab7253b3a5","sha512":"8045f83eb7ff1c9370e76c609f1eabb8e26562994956e9bdd01861c74e446adf7b55621eb49bd7dce663a8a665c872dda2223b2633c3b5bddc0cabeeff29b3f0","ssdeep":"768:BEghwqT4/62q0DkksmzqhxZ3WCKq4tvPgHv:WgiO4CJ04ksm6nK/vuv","tlshash":"58d2f13b1f34645dcebd411f9e373d85aa54d166f60008b9cbc597800bab3e75b2a8e2","first_seen":"2025-12-01T07:25:15.419855Z","last_seen":"2026-07-22T10:11:44.608644Z","times_seen":4,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-10.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.850Z","timestamp":1784715070850,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-10.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-10.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehjg67cf29u-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pZm7iIWRZ8xMjTzvviYe1SC0aNdYTM09tTg5kVOII%2BPOO43E8xYZ43FTH8ogZASd0WgiPvuT0DuhiOTxpz6rTAlkVkTiTpCbXIY5U%2BniSpWC6%2FZ3y9U%2F%2FuVQzPnwtA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8cc0bb4f7-OSL\r\ncontent-length: 1341\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2946,"size_decoded":2371,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"bf19e0bcc8b2548cccf8f41676d98487","sha1":"3141412148b5170366857d4458eb3a06999878fa","sha256":"fa71cd3e8c51271d865c74f200eddcceaff5aa1caefe4f67c6e9e0e0ab0a7f7e","sha512":"2235b1ab0256802dccdb6e07a39cef8cf01df0869ed130a1a125d07632b8c7e932d873668b7e23819f80e0e607310a53f1e0da0d8261c46e6c0a9d672e11a9eb","ssdeep":"","tlshash":"2a5189f652d5b2e0c107efb0e923d5e9724e34bf2f6692c64049e9a4e2952d5c89cc50","first_seen":"2025-09-23T10:56:20.513339Z","last_seen":"2026-08-09T10:37:17.204024Z","times_seen":81,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-16.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.857Z","timestamp":1784715070857,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-16.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-16.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehjs2uwt18e-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dhe7Mm0WtcmBnubAGyfPEh6kYdUnaauHPi6AOjHbphFdwARqwdbt0D6Bnsnx8g3XS5HGz%2Ffd30pS7Fx%2BuSONefm%2FRy0y4EOMfVnWvE4lpA6ZXRj6wIE2szmI6yL2tA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8dc11b4f7-OSL\r\ncontent-length: 749\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1598,"size_decoded":1774,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"df765364cd8bf39b6551de1f34acc58f","sha1":"580a6d7a223af6f4339d2bfd40e5ef6bacd8eb3a","sha256":"9b389fd3b6c0a3d8bdd75fd84ac3375056828c4d5dce5e48756c2d9341b04697","sha512":"022d00cb40252b3c5a1df11f03d81183e599b5e892bd0749b800672c6d708e531e5306133c1ce84168965a4361db142f9061a11e30fcfab12f86386c99078fe7","ssdeep":"","tlshash":"fa311fc9f2cde7c5c747fbb0d9336464294638ba9e16e21943dba2a496080ecd17c988","first_seen":"2025-09-23T10:56:20.390008Z","last_seen":"2026-08-09T10:37:17.361576Z","times_seen":81,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/close_icon.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.863Z","timestamp":1784715070863,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/close_icon.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/close_icon.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehizi35g1ih-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=t6DJPQ0Vu2FD0v1GEBKmmYGKHAe7qSabVgKodJuHAmX0iqzBCZZEsewm0FBjnYL9SI9iiQ1mOO3CH49Xah3miH%2Blp7JBwzbrFZs7jSuy0KffsXe%2Bom7L61QO%2B3fjRw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8ec17b4f7-OSL\r\ncontent-length: 849\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1961,"size_decoded":1865,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d49bf81bab3667f50b44f5734fae7b55","sha1":"ae887c96b40885b4958e8fea73db9c07b4b4a89a","sha256":"a16192114e48d9fe47a8372b58cd743c39753935f5dc79e464cafe280d2d17d9","sha512":"c0d503d9345825d690dd8dddf779b9e10766e0ba37ce3782b90936d27558ba93772e29cfa39a0aa76f8c121dad6f82d8357f6728e6183f11f06a0fbfa08b24d3","ssdeep":"","tlshash":"1541cb9f73c2a9c0f506d3a1892db4903a5675fe3d37c2dc868649b1e7a02fd482cc46","first_seen":"2025-09-23T10:56:20.484081Z","last_seen":"2026-08-09T10:37:17.290568Z","times_seen":94,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/ajax/winning/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.010Z","timestamp":1784715078010,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"POST /ajax/winning/ HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 110\r\nOrigin: https://rainbett.fr\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":110,"data":"{\"exclude\":[\"2203\",\"1878\",\"2004\",\"731\",\"852\",\"1395\",\"718\",\"1424\",\"751\",\"2084\",\"1434\",\"1551\"],\"locale\":\"fr-FR\"}"}},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, must-revalidate, private\r\ncache-status: Souin; fwd=bypass; detail=UNSUPPORTED-METHOD\r\ncontent-encoding: br\r\ncontent-type: application/json\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\nexpires: Wed, 22 Jul 2026 10:11:18 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yjTxh8u1Bm7QkfYKtVqFqRX0Q75q1kDTi3YjywwBF3rOvOy8VTidvp32%2BPriRzhTG%2By0gxREUAkVfODPZhWQMUZZxuutzWq6b09rLVgeQ7XNwvkdlTHpOl90LggRpg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a9158d25b4f7-OSL\r\ncontent-length: 592\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":7531,"size_decoded":1569,"mime_type":"application/json","magic":"JSON text data","md5":"5ff7ae2afc6cf059d06aefa72cc095a2","sha1":"9062222d5103aecd0f701c79d051a53fa866dd9e","sha256":"4d3afd0c5cdd78eb0ab244d7b33f46548ab6190d2ad249ab4ad4d174791c24a6","sha512":"7c50321bffe244d17c499f3ee4521b24f4dff87a5fca12e23d0e5d6830ba2a34cb594b7d0593576cc562149c63e1e5a7754ec4cfb0d9a24fa4cd37a043078c9e","ssdeep":"96:OfQfR+tfa2fR50PfdXfRp3fRDzfRYQfmNfReXf6fRCqfyfRhMf98fRO+f4fRp0f/:FcT+","tlshash":"05f1ac166e61e33f71c760e0ccb7efde1448e966902c8528fdbf2992d7224145f89a1e","first_seen":"2026-07-22T10:11:44.610702Z","last_seen":"2026-07-22T10:11:44.610702Z","times_seen":1,"resource_available":false,"data":null}},"time_used":376,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":376,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/gillyweed.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.391Z","timestamp":1784715078391,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/gillyweed.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/gillyweed.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\netag: \"dhcvecockfw74xd\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VBCXy3MD0yzp5n6o%2BvdmdI1twPqxHv56jxon5ocljTZhODUYaYR7%2FsEiNAZbhzdOyJJ9CDc6BOCCPJBGsoJhfctaKwzKm6hw4QDIOxJSygD3ZkW9qdhfbu%2BeA4dh2A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a917ed3eb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6385,"size_decoded":7387,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"15302b463d85253295e447c6b6724fa7","sha1":"f355ef35fb7dfd34ffdf335258b6d4c9923c1f7a","sha256":"08f39f01e68b23f8b73aa3561a09a6190909fa129de2f8ecd2cdc16a8f2ca14b","sha512":"8f3d12fc5ee2927926873bb35b4f06e7169adee8ffd04e79d4da67f544dccf94c1337533b20a9601f58936e32e6aadfbe8c406f535fd638dbcf5a17a5bac2e5e","ssdeep":"192:XprHiAyDvRYzvzMKrhixbF+XoJd1RAiMoBxnG1GCS:ZLi/Rgz0xbMXgPRAiTG1GCS","tlshash":"3ad19e76a7ace060d0fe63fdd6c602c4554595e09d2007fba3a67f192334680196a86f","first_seen":"2026-07-16T11:27:37.589693Z","last_seen":"2026-07-22T10:11:44.612084Z","times_seen":2,"resource_available":false,"data":null}},"time_used":128,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":126,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/captain-nelson-deluxe.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.402Z","timestamp":1784715078402,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/captain-nelson-deluxe.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/captain-nelson-deluxe.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\netag: \"dhcvecs92kdsiix\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TvAPyI241AojNCBJXJ5t%2FbM%2Bee7XTMyxzeZksx5dU6kNodF9UbevM5wfIvXSY%2BDUt%2Buur2G9BKXT9ZQEIe25aP7AtCL3mg%2BU4E94JNHz9hf9mbYAk2N63xaNpu%2BAbQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a917fd42b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24009,"size_decoded":25027,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"79668ea368babf9cbcfcced2ae5eae0d","sha1":"d347f449e2596d16a50de00ae1dd4e0eb1f2e48d","sha256":"f3142ce5048a9c5df7856c3a03e80b58da331d550713e59cc86d60e33c8849a2","sha512":"879b94747b661aca742b13219364b83a342dcf787a516a91743e69aad55ec1ad769b2025cac25f0859f6ba292908eb73511198af13be8cd30d93dfbfdf1e769f","ssdeep":"384:hT3BoIsg+Rgbg6YLzU2mXXL6TfjM/YjRWFiLijWvoa8x9d47plkSXn+92d04R:hVod6mzfuL6jjLjRe0ijWvoa8xDukSOK","tlshash":"beb2d04ae1516672c02c832c77877618ba377cc1d6e8615ed9e033f2fbb52d259a278c","first_seen":"2025-12-06T17:29:39.274403Z","last_seen":"2026-07-22T10:11:44.613238Z","times_seen":2,"resource_available":false,"data":null}},"time_used":418,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":362,"receive":56,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/wild-wild-riches.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.806Z","timestamp":1784715070806,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/wild-wild-riches.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/wild-wild-riches.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcved2mybkvsnr\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vBUlpcLHr%2FPgihmqQte3vtVEXElZ9d9nXXInNf2nSUHjyfMXEPuQOP1yEpe0N6i2qdEoKSDyIA54F36hOyqiYHOMg%2FfcEzr5s9yfmOXxP%2FNcteMjIrWGhU1XVhD%2FXw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e88be2b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":37143,"size_decoded":38161,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"d280b865e7472975fdb10ff0e287758f","sha1":"654676960f0901d17241a5a09d131cd0f981cd9c","sha256":"ea51caf0ea9f60f479f7462c75fbf36450d0422c5227fd4ae76ad68de554ae74","sha512":"006b05c6b2a08fd1ec1f55130967f932b2f758d2dd7a967ee2328a34aa16cff43eb8b69ef32975710fc91ed872230c422be480f88e1ca0cfdfb4cec2c4d8d881","ssdeep":"768:l3/1xeAw3EgPHceAIBiM+Sp/QBlSYJUugp/rFMfUJlvUzZqw+6mYGFlN5:5Pe93lPHsnop4eYmugNVlB6Yl7","tlshash":"e4f20165c9baffb1ecbfa6f5c2c2844b9b51a401da6962405d3786cc3b93821b8350f1","first_seen":"2026-07-22T10:07:06.262203Z","last_seen":"2026-07-22T10:11:44.614554Z","times_seen":2,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/conqueror.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.828Z","timestamp":1784715070828,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/conqueror.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/conqueror.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecntildy50o\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:41 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BxSckeqnEd6w0usURmuL9Iark5m57CN1Uim4M9EWoQX%2FSrJ8JBGU6eN%2BH4gnkkw%2BpaD5ZSMcJ94IMyGSoYJ51VHKi62%2FSiSaQHYaZj1sUH8xv5JsGcttX8bB2ktNeA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e8abf5b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6504,"size_decoded":7517,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"3ed470312a386b19e84c26f7912e38c5","sha1":"20fed7116575fe28e4c1a80000a121ce75b9cbb4","sha256":"e5f87c5a52843cd47f0bebfacc92f3e07697c1d2b14722ec6e7615211304d2e2","sha512":"38db96d7094525a7596acad2d02fd37c32db103c74b4456c616c74bd6a883ae0d9493240214a986703f3a21e6d967c38fa5bdca93ce939baf3d6e3216d3dc92e","ssdeep":"96:5kdoU19UyG8z6FBedD6p0Ggg/iplgED61c8D6NyvGwfAxfktMrcsXtmcm:6yk2yG5FBTpHipdD6y8D6QUxfktfsdrm","tlshash":"65d18e236ed17c0bfd3c047263aeb7a9435b76021cbd567328dc144d1f5c465eba8424","first_seen":"2025-12-16T07:17:55.687472Z","last_seen":"2026-07-22T10:11:44.615163Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-8.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.848Z","timestamp":1784715070848,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-8.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-8.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehkn1czh16h-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b1OZIQbIhzpoMZvHNf2XOtszYJ2iZtuuJ84yzCagiB%2B1EOj8hPDaYjnj5WeyyLhDbuRv86APlWaxioRZPyHaWfoTaY5CGZtfjpKucAPsBbVK8bkfrlJqdE63MI3Zyw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8cc09b4f7-OSL\r\ncontent-length: 682\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1529,"size_decoded":1702,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"763cf41016fb36fd4e6ecb70afec92ca","sha1":"4457569ad0393c21813aaac73f12511d5b9e6964","sha256":"547e02336706c25450ce64cadfeea78c83d84162eede33a1c2d95c30984fc3cf","sha512":"bc4ccd2b40e5770cff41c0cb5b615c9a60f69ea413eb2fd5e48ea35f1c161e86ccc9316469c84e69a9d399ae55fe8eb5df0ea4ff51c9dd20b60cca6688f27623","ssdeep":"","tlshash":"033113fb934cb9d0df0ab7f0a66651a5651228ff7ab7c9dd82e12d168d5002ecc4c911","first_seen":"2025-09-23T10:56:20.417198Z","last_seen":"2026-08-09T10:37:17.271716Z","times_seen":81,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/castle-mania.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.409Z","timestamp":1784715078409,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/castle-mania.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/castle-mania.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\netag: \"dhcvecsdu10cnk2\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yOmjvKIe0xnlS21manbqFc2xueCaFHYYmqrwQhE%2BImyHuGbT7IHpdzXpQeWoUQLVyVtwrn3No4Z%2Fto32pA2j1iXgrJ07oJHlYE6dGuayKrT%2FDp9aATCAcOYdf1WiJQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a9180d47b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30530,"size_decoded":31533,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"ab97183d37cd7c33998a78fc68620a04","sha1":"6d7a7989f4354db896f038944aa1ce924fb8d8b0","sha256":"138fd85803d043194f201ff192487966121b053e53085a15175a5e2c3312b2ec","sha512":"5191ba91eef79f01dfac76028b21d17d6356fdb509141b451cfe922a97cb52d231aea189df14ea5f3017b0e05d1f2a3ad7f0d827a8e7b5f68fe006304983a282","ssdeep":"768:XRXCzKlLeJcAdW+owQHToCo0rQxEUAUWyfox:BCzKl9A2wMo0QI9UE","tlshash":"a5d2f13b7780c237e61fca309ac01f824729ddb41f95249e26778d1a72af786096dd2c","first_seen":"2025-10-09T01:23:42.818042Z","last_seen":"2026-07-22T10:11:44.616177Z","times_seen":4,"resource_available":false,"data":null}},"time_used":444,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":379,"receive":65,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/ajax/winning/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.010Z","timestamp":1784715085010,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"POST /ajax/winning/ HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 105\r\nOrigin: https://rainbett.fr\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":105,"data":"{\"exclude\":[\"268\",\"1170\",\"435\",\"1495\",\"1186\",\"1024\",\"4\",\"1524\",\"130\",\"411\",\"1797\",\"23\"],\"locale\":\"fr-FR\"}"}},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, must-revalidate, private\r\ncache-status: Souin; fwd=bypass; detail=UNSUPPORTED-METHOD\r\ncontent-encoding: br\r\ncontent-type: application/json\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\nexpires: Wed, 22 Jul 2026 10:11:25 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=84Z14tUMidAKbmtPt%2FwzXHYlutDXTEWw5S7JUzS9e8doU2AZ%2BKss4iLTM2xig%2FAawc6c7fu6rPbhy%2FOzCFI3houJ1IYQKI%2BDAVkhozXvSOHAQYgdLbc%2FQfiRILNYIw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a9414edab4f7-OSL\r\ncontent-length: 544\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":7501,"size_decoded":1529,"mime_type":"application/json","magic":"JSON text data","md5":"eb4ca5b67a6dd6dcda75ab7ea4487e82","sha1":"05b97ba2986ae1e44a62091298986be222322c31","sha256":"205062fd406ef23e6d77b5e67fd4aa3d0ef7e0da818db1457aef1cbcf9ee6266","sha512":"cdc6c0f7a78fb426145b92d2b7e404f3f39e2a7a6b068f9f7ff92f72105c36ee0655f8ceab7311d13b96112430814151e3b2c72f95387ed61c1dd8b92f117670","ssdeep":"96:+fM4fRxZfMP2fRw0fWfRLpfYP9fRxVf4fR+sfMZfRoVfvCfRsaf/fRRafZfRl0f1:raPN","tlshash":"cff1af266e61e33f71c760e0ccb7efde1448e966502c8528fcbf2596d7224106ec9a5e","first_seen":"2026-07-22T10:11:44.617205Z","last_seen":"2026-07-22T10:11:44.617205Z","times_seen":1,"resource_available":false,"data":null}},"time_used":370,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":370,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/diamond-empire.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.400Z","timestamp":1784715085400,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/diamond-empire.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/diamond-empire.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\netag: \"dhcvect8sj2zmw6\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I1SENUIRYpgZ7UFq8riveior4tjpmYc5f9t4E0%2BIvGFnbVJt4nODuVu5Jf2UXCuYlsaQ%2BbwJ06n3OrXbGL%2FsDp3IbsdKrdFxvWiFravO6A3pqqtKDvcKtInrvB8jkw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a943bef7b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29670,"size_decoded":30675,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"df411e07659772fcd767591d21052a4e","sha1":"d54097ec3d99d548f93284d312fee81137f789ad","sha256":"c237ee508dd9af409073ddb341200103df9f1c52fd5de2b7c18f46a2926122e1","sha512":"e7f092a396ac86157b1ecb831664f9fd018036f894fd6ce4ce7256f6e5cad18a2921d71d498ed4644e342e423c36b351f66dffa3105ae497cc3483dcc43c2061","ssdeep":"768:sKKc+ilMRPYt8w5tyFABya5kQjTN5a1Lxc:yQmFYt8mtyFghTbae","tlshash":"1ed2e1fde383badef71f80da60193be381016e03596a8b23d80599579732ed61c4916a","first_seen":"2026-01-12T00:47:03.66905Z","last_seen":"2026-07-22T10:11:44.618449Z","times_seen":2,"resource_available":false,"data":null}},"time_used":418,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":356,"receive":62,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/shopping-spree.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.457Z","timestamp":1784715092457,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/shopping-spree.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/shopping-spree.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\netag: \"dhcved04gjo7k49\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MA8Q9eo%2FfPwzS97S9lMDt104hhA%2BMXGU3Ps0ZmFuAAhVzaaXRBmJJ%2FsoNvzyn7wUHiZltfGyUV1%2F%2FHhxg0b9eZ5IuOsjoKGiUPvDK53%2BQUrgN8yfa01tfg89tILcDw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a96fd862b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26073,"size_decoded":27084,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"8666871e50903ba8b70398808f739ebf","sha1":"a139938860d0e7d97154444eb074f07fbc16bb4d","sha256":"8f978977c65481fe99cffc3cca6602803d982b3e7c9376abbf89d8a4c4494e16","sha512":"f7484fd9c9d007e96be931cf10912c7e51fc65cdd0d30ee6c212c196f7faa199c2d0c61b0733a739c4737a222e908c0d635b34d0ae77cc37011c9bf8bc27e1d0","ssdeep":"768:3vmLjA81NguDwNRM9sVvhZKf4EKOfPE5d3o:3vSAyN+M25Z449OfEd4","tlshash":"6fc2e188fb70a719f0ab7a9cd70ea4707e4568587827ea4f2da47f31cb325491d4a071","first_seen":"2026-06-01T02:18:17.523222Z","last_seen":"2026-07-28T17:21:57.941628Z","times_seen":4,"resource_available":false,"data":null}},"time_used":178,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-3.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.843Z","timestamp":1784715070843,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-3.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-3.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehk6d8si11j-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sg8AAJkNIKlOGlw7C1jrDG0TKS3n3plawEpwC5T3jJdFqbrnH4MPLQf94U9Fv9oF%2BzRi2r0SleSJMImyWBZzNOcysLzGQkpPcu93XG7%2FBL0VrJ%2Budai3spM6wivyEw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8bc02b4f7-OSL\r\ncontent-length: 694\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1351,"size_decoded":1718,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"33b94027ae50b91d2a3a44ec8e039a69","sha1":"f9e407e96eb2aa87d114990348504be1862fe020","sha256":"1073180f688f90b2de978352e506c3281fd5c14197d771dc45bd8d0db2f269c5","sha512":"53b4a8fe61fba98872373276fefc13d7bdb072558673878d9a219ac88993b870b892208bd7185ff1d527158cfbac38986d6865b37dc86208c5d1fd43907f6a1e","ssdeep":"","tlshash":"fe2123e692dc95c8da02d7f4c52ab0d2316f25fe2b5ec76da3e4ae643c1402c850e997","first_seen":"2025-09-23T10:56:20.416179Z","last_seen":"2026-08-09T10:37:17.2769Z","times_seen":81,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-12.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.852Z","timestamp":1784715070852,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-12.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-12.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehjkxnyz2xs-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LQ9RnZwAc3Eh%2F%2F7g0u09Ws1MuiXV41f44GgdqxMaUVcOuWP3By%2FmJZ6wdqGxUkoAJUviaMxw0v9aKvWNhAseQbT7HXETD2yIqnlN9Me%2BJIkssWMCbiLcVh4TQMUJvg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8cc0db4f7-OSL\r\ncontent-length: 1704\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3808,"size_decoded":2732,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3dc1b0be849e1a76c39d73119c54a4f2","sha1":"ff8c4c594605b5cda33a996ab2517c08639c39db","sha256":"65825152ab6d1b8d197cc531a0458467374105a29935f430f2de99b9b7c5925c","sha512":"b55f9fcdac28dd4f93e13cdee62019222442403ecf69e7c7a6012920dc52e8a5f6ae6576f82586e93a265af089d970f5a9878e27479df89eec40e3dab08f84b6","ssdeep":"","tlshash":"a97163ffd7c8a3f0940ae7b4ac13447a73ee3c7b77269b4543808694e75519888cc840","first_seen":"2025-09-23T10:56:20.252423Z","last_seen":"2026-08-09T10:37:17.247808Z","times_seen":81,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/build/frontend/images/close_icon_alternative.30d11eeb.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:16.960Z","timestamp":1784715076960,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /build/frontend/images/close_icon_alternative.30d11eeb.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/build/frontend/app.css\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\npriority: u=4,i\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/build/frontend/images/close_icon_alternative.30d11eeb.svg\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:16 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 26 Mar 2026 16:58:57 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s9D9a8bi%2BF5M6Hxy%2BsfaKDq%2BskC8wMQgfax6LXMRzRubLJJ97hUdnJwwg9KdzK1Nh0jBhiPB%2BonFxXmR2NnmunEz3YW4yOdFnnlUyUQTDVcj5072rx%2FGaABrMIpOaQ%3D%3D\"}]}\r\nage: 292\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"dhcvgu9uccun5z\"\r\ncf-ray: a1f1a90efd11b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":215,"size_decoded":1175,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6f9483da40b704e14271539a745abb95","sha1":"66fbac8132e78db3073210c24d70368931194f0f","sha256":"674f051b16abc0fc18ecb639d06d5ad9d3c8cbb7fba4dbc01b86d52a110037a1","sha512":"85ebba8a7956f2cfc4e8ecb92f07f4d8352e96cec0d520b10dfc3073b11056fd59a5c80f464d3b2416622c66583491d02f0508d9176835a04ed8b57040370cf0","ssdeep":"","tlshash":"bcd0223e32084d2eb0208620e7a83135506a61435a89205ced3228332201a6f7c3b6fc","first_seen":"2025-09-23T10:56:20.51039Z","last_seen":"2026-08-09T10:37:17.177215Z","times_seen":140,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/ajax/winner/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.013Z","timestamp":1784715078013,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"POST /ajax/winner/ HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: fr-FR\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 85\r\nOrigin: https://rainbett.fr\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":85,"data":"{\"exclude\":[\"804\",\"806\",\"384\",\"914\",\"481\",\"171\",\"218\",\"639\",\"931\",\"875\",\"676\",\"252\"]}"}},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, must-revalidate, private\r\ncache-status: Souin; fwd=bypass; detail=UNSUPPORTED-METHOD\r\ncontent-encoding: br\r\ncontent-type: application/json\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\nexpires: Wed, 22 Jul 2026 10:11:18 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xfsHD64vb5FvH%2FAuk37O1EfBMMQpphJ1%2F8N0z8huG5DEx780Uo6LNh66tqAD%2FhQThGCVfBs2GQL3cV3diU4%2BVdU8kEdswzQZWTE%2Fq8wa6Es8KkZWqz0w6k%2FU6YFg1g%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a9158d26b4f7-OSL\r\ncontent-length: 238\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":599,"size_decoded":1223,"mime_type":"application/json","magic":"JSON text data","md5":"7e89f72c0bb6dccce77915a31f7e5e0a","sha1":"13dffdcab1ea6a4a7444467e0e532536f16cf9ca","sha256":"b753918902685f603230db1ee712702770ea630d58377a282c256ca60d5dc4e3","sha512":"9490ef3423345f11f35809af2e5328d4c4589b828310c4cfdcc2d557cd058a592297625550f2a647815300e3c6f44553b5ed2894de261883346631230226640c","ssdeep":"","tlshash":"1cf05492a616b33f618350d0dc77efcd1414e852941e8434bc7f49a1c3228241fe870c","first_seen":"2026-07-22T10:11:44.622234Z","last_seen":"2026-07-22T10:11:44.622234Z","times_seen":1,"resource_available":false,"data":null}},"time_used":370,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":370,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/ajax/game/","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:28.962Z","timestamp":1784715088962,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"POST /ajax/game/ HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 114\r\nOrigin: https://rainbett.fr\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":114,"data":"{\"exclude\":[\"2203\",\"1878\",\"2004\",\"731\",\"852\",\"1395\",\"718\",\"1424\",\"751\",\"2084\",\"1434\",\"1551\",\"2180\",\"2446\",\"1033\"]}"}},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=0, must-revalidate, private\r\ncache-status: Souin; fwd=bypass; detail=UNSUPPORTED-METHOD\r\ncontent-type: application/json\r\ndate: Wed, 22 Jul 2026 10:11:29 GMT\r\nexpires: Wed, 22 Jul 2026 10:11:29 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: PHP/8.3.32\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=msUP8DcH4eL3wQDGY16Y0xlegRE55Lrz9QfmtyG5NkcUTE%2BWiu3z0TCJjrsvdI72g4SDXXErE20cdvA4CociTsp8csrGhtAkzLr%2FxJgVXjJeXTThxBApyq7q3dmmWw%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a959ffbab4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.3.32","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":90,"size_decoded":1034,"mime_type":"application/json","magic":"JSON text data","md5":"0af471954c6cfa5234d0381e7b93a544","sha1":"de7c0e50076f508192f24d4d3cb66d4cdcc03f89","sha256":"a228367100bdd1d80c613faec052691073b45d734535bd867c9edadef954d962","sha512":"93f3f36343b5d709c8cd81803a9f69f04fa705c1eed2f2e62f161b603ebbcaa76f736a996a1506c47cb792f4bd548cdb33602c1108b358d835766383f50d8b4a","ssdeep":"","tlshash":"1db0129f4061581782b701909c06708060500dc308644910f396c89044505011012e4d","first_seen":"2026-07-22T10:11:44.623237Z","last_seen":"2026-07-22T10:11:44.623237Z","times_seen":1,"resource_available":false,"data":null}},"time_used":339,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":339,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/pamplona.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.459Z","timestamp":1784715092459,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/pamplona.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/pamplona.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\netag: \"dhcvecystxelll5\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EAosO2USFemSrDC%2FqC%2F%2FnKJHVJihAZ7JzB%2Fr3CwGmm5gRdx6I6pMqiwL9Fwtwg3gMckBHdfSeQ%2BNBnAstK%2BRjLoIrLCHYY35ELJoX%2B8%2B4KnksmmqwLFgXA8ij5xtyw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a96fd863b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27977,"size_decoded":28986,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"5dbce4cfe02ac99e5ee12d56701d6b37","sha1":"572b69ead94f8c89f0898d6278019f8463c3223f","sha256":"ff8a94b11b270b7276c406aff5d7f26fdebcd0c707fc1e1e8105c1088898cf83","sha512":"9f466660130a8ef04928bbdf3f2499872aa9aeab2417d199e18cd73191a73835e32e76272c400980583535ed481e57f68d25ab9f3f43587a2596b2c2bcc1f562","ssdeep":"768:rt4lBNK+9a/iqg06BcezVPl2suWsP9RX+uye/:54Q+9xqJ6Bci9lVXsP9Ruu/","tlshash":"c7c2e11da7f0a662c53c25b646d99f234621f4011865f722b81f7c28fbb92d1f5cde90","first_seen":"2026-02-01T16:54:15.995603Z","last_seen":"2026-07-22T10:36:34.557476Z","times_seen":3,"resource_available":false,"data":null}},"time_used":368,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":308,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/live.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.835Z","timestamp":1784715070835,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/live.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/live.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehm11pkd1bg-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2B9Nxp6%2FaJsVQNXBMaHe4y03tFpk6v%2FlTKIjqdBoDrErIa8doPp41Q3UYUZXAIGrxT%2BORUxlEGHzPRxPo3aHVbBf2nv5XggXoTWE7Hq5CzgHingbJEcVOO1ujrDMFxg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8bbfcb4f7-OSL\r\ncontent-length: 783\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1708,"size_decoded":1795,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"424b692dbdf804909dfa0f0e05875db3","sha1":"035533bb122a899b689c3c92ba852f1cb6d5aa3e","sha256":"cd67b8fc999babe3806e7104c2ab4c2290a7fec77cad61194596eb71884107de","sha512":"54c63fd0ad9e267c765abcbfe7127547e818329b17ef31b379a23141da7024aa5d843010f2d4c517bf3d336cb512d33b8ea2b8032fd6aab8c3e222ae8ffca3a8","ssdeep":"","tlshash":"043154f6636433c8d887c769d696be66333718f4372286c84be82a64cf61c8d5d54c93","first_seen":"2025-09-23T10:56:20.356068Z","last_seen":"2026-08-09T10:37:17.280072Z","times_seen":45,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-5.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.845Z","timestamp":1784715070845,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-5.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\npriority: u=5,i\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-5.svg\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QCt1uKW89WliuRg%2BzYjsfCMWxjVL0NrMgDIXSfY4g%2FWdsbxxbkk7Z3QO6Jhbpp7oZMAWgrA0Wh2PiV3MSF4AbxVHsddlgsFP7xO6jBodniBBa5utcQzm2qKJrdPB7Q%3D%3D\"}]}\r\nage: 292\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"dhcvehk6d8sidb\"\r\ncf-ray: a1f1a8e8cc04b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":479,"size_decoded":1275,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"44437bc074c7c0946c518a802a0250db","sha1":"1b42f0ef63627752dc0d0b2d0f835e062484ba3d","sha256":"eeeca5b3e5758a03382583ffd0130b9640c4d4538dcdc7da1f6af5a943b522c0","sha512":"fa0416cb6707155a511635b8e2289f0e3ffe04a23b8ed026ff81cad154aaf0f8f6e1912d3ff48996644eb27a4139ab062a4ff6c671e22d5b2bf756e5bd192183","ssdeep":"","tlshash":"d4f05979b34820405a2cc73099dc7cfe316f322623845088e2f95cb4e4512a91a069e5","first_seen":"2025-09-23T10:56:20.362497Z","last_seen":"2026-08-09T10:37:17.172341Z","times_seen":81,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/apple-touch-icon.png","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:11.291Z","timestamp":1784715071291,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/apple-touch-icon.png\r\ncontent-encoding: gzip\r\ncontent-type: image/png\r\ndate: Wed, 22 Jul 2026 10:11:11 GMT\r\netag: \"depnh2ew9bswmao\"\r\nlast-modified: Thu, 04 Dec 2025 18:39:50 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=6,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b3ddCjMu8qAoX1ZVCnN8m8UGkspyKf2Ho3fY%2FBedAkvaWXdhJmP09JRKju1AQwT2x%2F1w2LOpJxO1LR%2BAu22XATUEMcAyMiOGNCPmfHs67PC0EiGcOvFgXkjNh7hFEA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8eb8c35b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28896,"size_decoded":29894,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"5d07718e180fccb06278e168924ca478","sha1":"6e15a0cd43c05b3344f420c9c3cefae27df3745f","sha256":"fd0ca4e9284c27250808008a4543aa282bc1b9c32d0ef36c3f6fafbbc7a7bbea","sha512":"a8e95221e0be0728c8a17f9f889e90b3fe7e4413668c750192fe3b2ea2839bab9a858aa89982d8884638438f485f61020204aa40c58b96c542a1049e8739204a","ssdeep":"768:mLgFKbhP9iyRMUH0jU9Vvttv7FbDPLN4LQt9a1ToeU6wfBUAAalu:bKV9iyj0w31zNV9USdAalu","tlshash":"73d2d07899c28bbd606f456d0dca110eaa9eaaa564104acf3da87e647cc39cc1c0f5b1","first_seen":"2026-03-29T06:05:12.862655Z","last_seen":"2026-07-30T12:09:04.915205Z","times_seen":31,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/wu-xing.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.410Z","timestamp":1784715078410,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/wu-xing.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/wu-xing.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\netag: \"dhcved2u3iippqs\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JVgT1LwgqjPVK1opG4zEpfXd6uFCuyNo%2BsM2LgWQArdQplwEhgb9wSB8gqNhZNi9LkwftHlclwWuDtneXkSYg1b4xeclxzJ1nQAG0kXD5X1I9STkcQ41RHqFS2MV5Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a9180d48b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33364,"size_decoded":34358,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"42b28e8e3e23f4a439eab4fa100a29fc","sha1":"ae4cccfd02c2af8324bd74087a31a9d015bd691d","sha256":"9c18ba6a2c77de80adfc3f78ae02688374efb268fd03ee7125c7dce0f6347f17","sha512":"78613c0e3a724ebc309e336122d8aa9ffff1d39d16817cff257756c1f8025b02dbe9282c2cce776e1c89df4655e16f2c76689c6d54a8c9ce88ee36e99283cb3a","ssdeep":"768:xaB7iaSHzAFfa/I/hODPc9j+x4sW3QIUQYomTP2hgnuP4:xM7iLzSaA/4Pp4sEWFvTuhk","tlshash":"9ce2f19cdecd9be9ea5f63f60391b6614402de9c3d2753a320b36d85576d141e1f8320","first_seen":"2026-06-07T20:26:45.800014Z","last_seen":"2026-07-22T10:11:44.627679Z","times_seen":2,"resource_available":false,"data":null}},"time_used":444,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":377,"receive":67,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/jewel-box.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:25.404Z","timestamp":1784715085404,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/jewel-box.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/jewel-box.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:25 GMT\r\netag: \"dhcvecxetktomqh\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uM9Y5elUrMUuTzAo4oVKfm5j5o82tgyKx1%2B6YN7EyTL1vH%2BkUhF8oNESvt6R%2Bca6fCrBzX8OKw1DEaWBaUfgC7tWoXFjUeyXOW%2FaoU07anv9YwocKwgGC6P1zg%2Fs8A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a943bef9b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29465,"size_decoded":30469,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"9735e0998c606717cad1d34f7933a4f6","sha1":"df238849de0bdc35266d4f5cf1ce18187333af8b","sha256":"f1cc098a2ffcc9039216e0d8bb567f7713a6eaaf0bf9aee78d2fc70633ff175a","sha512":"2183d74fb7c9a1559be3103a2e6dff273ee341742bbb9f98adfec1d21e55d97a91720bd93899b1d776ac701bcb051e2b33b722180b6af40482307b405d1fb3b4","ssdeep":"768:m+R8QFy8poXP0lVdTMjTYA2A1xwUiExGN2DFoxCo0:m+7CMl4jDd1GUiEx7KB0","tlshash":"f4d2e1cd19e9793b957e27a3c047947e9e212f3073e04f4ea073b522663a5fb5402199","first_seen":"2026-03-21T02:18:55.577405Z","last_seen":"2026-07-22T10:11:44.629102Z","times_seen":4,"resource_available":false,"data":null}},"time_used":460,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":397,"receive":63,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/2026/03/logo-69c5655cbcc312.99701337.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.789Z","timestamp":1784715070789,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/2026/03/logo-69c5655cbcc312.99701337.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/2026/03/logo-69c5655cbcc312.99701337.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcxh7h3r01s5rg-br\"\r\nlast-modified: Thu, 26 Mar 2026 18:33:28 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CqRV6dcu5uLU%2FB13caa%2Ffos60fiUFuJm21V19OVmicX5fCjbAabcS3BbMW%2Bx%2FI%2F1caMBhSv0EjNGkThyUBEbYl5GMC6yun9H5ERvbFW665LTKqjOhfXXw%2Fgcx9%2ByCw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e86bd7b4f7-OSL\r\ncontent-length: 3345\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7468,"size_decoded":4406,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f0395160c2e4611ae5758d0fee241b8f","sha1":"cc37cf9ffde6c684ce9ee7d84a234501e6d14c3e","sha256":"350ddb9948e7775236b470d6eef852c2fe61b4498d61d24fdef720657d75189e","sha512":"83e74196563da22e1ae36e5a36540cdf7985e19e1d24b77902f87ceeaa2bb06e8cb91b3bcfb19a36c18eca9983db2a9f45afc4973a39ced42834e22c7f0ccb42","ssdeep":"96:YbA+/y7l0QJHLX4xSvz/Q8Cl7Mps3khFbDQy7Hl3CunJlXuCGEfgqo0hXoXSRyzk:YbZKjJsxaz/QLQLLHlTuC1bBoXftVPw","tlshash":"a9f160dd2f725de046cc8bdfbf1250ad686790b79c9a8958c0199f0819c2c2dad0ade3","first_seen":"2026-07-22T10:05:30.579777Z","last_seen":"2026-07-22T10:36:34.475951Z","times_seen":5,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/arrow_left_icon_v2.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.796Z","timestamp":1784715070796,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/arrow_left_icon_v2.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\npriority: u=5,i\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/arrow_left_icon_v2.svg\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2B38q%2FoCV0uK0V1sa5rCBX6Oe4gSkrrul%2F%2F4H42Vu4nLjHC9BVZYKGA2ecJR5%2BBDXjhdNR%2F5IvOOfo263%2FTiYlB0M64fDJs8WN%2F4hcsxRjZXvp3l7TtdGkbyPUTfvUQ%3D%3D\"}]}\r\nage: 292\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"dhcvehix4cu69y\"\r\ncf-ray: a1f1a8e87bdab4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":358,"size_decoded":1192,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d43950a1d8af3589210fa71aa5acd465","sha1":"29a98044aeae858e3c7c4621dbb0718360eb02f5","sha256":"bb897b7645e3d2de927772e4153777864daa5a85e584a6b8e05d0a90182aace5","sha512":"1e06cea8611ea8a204bde96441c6647395e6690052673bcaa32c5201cf0fdc8d3f32d02743e32b34f7d70a6fb5f3a11993809e007a7fd54c68c3f10796c2f853","ssdeep":"","tlshash":"04e026a5230c8c3cba224b28f71873768465129346d82198c9321a32694856e6d3f9d9","first_seen":"2025-09-23T10:56:20.446845Z","last_seen":"2026-08-09T10:37:17.183503Z","times_seen":62,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/rome-egypt.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.817Z","timestamp":1784715070817,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/rome-egypt.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/rome-egypt.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecznsfh9omu\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LGA%2F7tW9REbuF96syaeJ0VGdr9N8TydjG3%2BQT6zuXnNHXJ7czjBzNJEEo0d7NMio9zUu27feqv9T1POc95rGIykvCNMqm09iO2TfJEPSuCPQ6F1sPpjuYLF0WRHJmA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e89beab4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31926,"size_decoded":32934,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"32aae8dc49b565265866a476a8eb8de2","sha1":"d5804ff4212d25c72b83a5f38b2b2decbbc3b481","sha256":"b3cb248d2fd91b01ba4668da8fe3d082a9d970dcc5a237287564bc9d92a34521","sha512":"a9f14c292884fafef4f151dbb7ce800952dc3d106b9ca0e42a88e5da99d37338dd726a33fa0a4f6afa88e08f457254a7a59200d0bc8b57a9f81bd57b981a1a37","ssdeep":"768:QMWcouGE+25xV0L4EDoPmATwJ6QflMTbL:VDouGE+2EvDouAcJRibL","tlshash":"47e2e12214c34e4329789e95c717f1c0b4135e153c7339ab5782baa8eb73f68924f762","first_seen":"2026-07-22T10:07:06.263917Z","last_seen":"2026-07-24T11:50:54.390849Z","times_seen":3,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/dmca.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.871Z","timestamp":1784715070871,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/dmca.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/dmca.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehj1vtgq6v2-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2BeUB0Pm3G5aESkzen88bfM06wRe5UzbM8L1aOKWOG5A%2BOquvgp9Alwa5HUCC35%2B4VrMH0qTSmjZZkdXoOA9jdWhuKIOzX%2BO3Dz1cRpBR%2FZTczuyVxtimURXmVwc1A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8ec1cb4f7-OSL\r\ncontent-length: 3556\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8894,"size_decoded":4569,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4cd080d755657ddba0a3f04a4e8f08f9","sha1":"15e0daa5d81ea5d512082de011bc8f4cf7673262","sha256":"fa7d304ee7b5398417be1ac03f89d39cc0598a48ed145581afd6a5180e58ad7a","sha512":"3084640dbcaddcb49f23460b930352043d762ec17cf27f34039a4e3e2e7044396de30026d06ecd96667c66d47ccab14b93ec7169b3facd8a4dde4e94dd58b26a","ssdeep":"192:a6m66FkmYlYoDVfveKNA2L0wV+kENRWp8h4zOpjyhRaF02v+:a68G1lYkVnzL0w4kuEp8h4z4jyhZ2m","tlshash":"c002ba99637693fcf402a3f9c6166c367daf2de57681d258c3a10d52e0d206d1da8ccb","first_seen":"2025-09-23T10:56:20.3528Z","last_seen":"2026-08-09T10:37:17.291205Z","times_seen":92,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/build/frontend/images/separator.b41ea2aa.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:11.245Z","timestamp":1784715071245,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /build/frontend/images/separator.b41ea2aa.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/build/frontend/app.css\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/build/frontend/images/separator.b41ea2aa.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:11 GMT\r\netag: \"dhcvgu9wq35w1fl-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:58:57 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9ygMrqd3QvAWgHKiT6zrUOIGVzurHPHiJDaE%2BmIkvICMLd1yTS%2Bs69%2BLFxwOxr%2Bun8dPmkmLxrb4gOdhUYudZXOK5Ht72xHR3A7FdDF25uCHx%2FZlpX8vZJGj4leLoA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a1f1a8eb4c2fb4f7-OSL\r\ncontent-length: 477\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1857,"size_decoded":1523,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9daf1b07e5b803bff6868eb008f09ffe","sha1":"3218da25e54049accbecade543d951e38f2b65df","sha256":"909f4c851ec36c9ddf133927ffd875944fce26ab178ede5c225d633c7b2c849a","sha512":"054133a5bbf13be7352e1b2d1f4563ef67521c227b80c2fe9fd2ac3588b074baaaa637db1a728f1fd55c36af78548f3d3fdd00b43666973d921ba2d415bc893f","ssdeep":"","tlshash":"0e31ceb4322cf019c6194b0af1e36af8109fa2cfcb62534dd29079975925ae739147ec","first_seen":"2025-09-23T10:56:20.413635Z","last_seen":"2026-08-09T10:37:17.233075Z","times_seen":51,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/favicon.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:11.297Z","timestamp":1784715071297,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/favicon.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:11 GMT\r\netag: \"depnh2ew9bswo4-br\"\r\nlast-modified: Thu, 04 Dec 2025 18:39:50 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 291\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BZNQMh3CkivcNLFcGCaoyWB2ntz5MuIrQDQi31QnQyf92EZ29cjrcD81ydq%2F%2B2I3oyz4XnBXKrSuAmwwAyteiZ916jZ4eUPARTiE8h7%2BFX2uV5MbFt9Z20iTdxM%2BiA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\ncf-ray: a1f1a8eb9c36b4f7-OSL\r\ncontent-length: 591\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":868,"size_decoded":1604,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3f020712c7ce478d0888983f287be168","sha1":"5e3d9bb81498857653fd87068841ab98709a7a36","sha256":"bb896bb442ca9c16570ad15ae3872937ed9a0c5fc5582f7a2e8f5b495b277c3f","sha512":"8645aecefb44c388b4ae308a3c007f54061f7db1b0840fb642dffe3aaad48d7ebbc4b2c8881a64a08b2d7973e97f01ceaa73d1ee7f455878fc2326a3c6ad66a8","ssdeep":"","tlshash":"381123fa940a206d635a8724a13dc098dc516903d1bc4212be42a915fdbd56a782b69e","first_seen":"2026-03-29T06:05:12.858184Z","last_seen":"2026-07-30T12:09:04.773989Z","times_seen":31,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/dragon-horn.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.395Z","timestamp":1784715078395,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/dragon-horn.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/dragon-horn.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\netag: \"dhcvectkp6nemxr\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QCYDuhrrkNATU3T3i7iQM8luWhPAmXT1AO2i4buLreGxe2EmJ2LmwmH3PUMf2tNolR2SFxrmw9kKe3%2FVdfU6zwyRJ%2FfgY%2FESrQxqQKF1QgyJ0pD%2Fvk1uYAQwJN294g%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a917fd3fb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29727,"size_decoded":30731,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"c0d6701d8c517f6fe166e8b8ed3f7de8","sha1":"195d22ca9d4bd9a27a10b980864a3f92f0fd3010","sha256":"b386ab4a36301a9f8e8550af397383b7fcd3719fc03368360ba039d948c25622","sha512":"a36643181d58ecdc70ff3a7a9a9a643705a107e8fb8052f4db41df9ad024e59ad029a6a9d1c47c1cc41b08c82a8f740c0bcc9cf78a295bec93e7210a35bd1771","ssdeep":"768:bMBq9dRMHbjyY9QNzKETy6L5Su6646oWL4ENpYrs:bVZMHbrpETBL2WPyrs","tlshash":"6bd2e08b617ced7aed5e0236fa0dcd081d2adc59da320e1e98140fa142ba1f93b3585c","first_seen":"2025-11-25T22:34:39.235837Z","last_seen":"2026-07-22T10:11:44.633643Z","times_seen":2,"resource_available":false,"data":null}},"time_used":461,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":396,"receive":65,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/all-ways-fruits.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:30.312Z","timestamp":1784715090312,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/all-ways-fruits.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/all-ways-fruits.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:30 GMT\r\netag: \"dhcvecqnx0v1cv4\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4JYRouie79Q3fIxOBtU8pr7y2qI6lSKIi7aXM0ACZGq8xGkb48NdJY0vI0Mu7fADxX4do4xgY%2FLilJ5z3RkHA59A7aPRKRfRa%2FCiUX%2BgXzC2iPVdvqQm%2Ffba3JxtDg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a9627812b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16672,"size_decoded":17680,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"2e5b556c63e47bfebb8244e52601141f","sha1":"7e959e5cad08bdbd9b48f4bd4469b13833b3a37f","sha256":"d5a03bdfda5449d061e6d28c36bc1aacdb068b73194705c5b1feb7b7713f84bb","sha512":"54b35f2489423cd00d24e0d3e1eee658c27be93f598940de0e68429e65de9b498c4b79ce572406de8e8ff6671d6dbfa5b735819fc3d6cac28b849ed8e931a85c","ssdeep":"384:ricrIwPDhN9XsjNwgYPZCjxhOO8EgrhhDmUIVLjgK:rbrPl8NwgYQxh6Egrhah8K","tlshash":"8c72c060ea389d17e54d53374e18601a5df1ad836e08c8d70549c26f9bbe9cd23b41e3","first_seen":"2025-12-01T07:25:15.247231Z","last_seen":"2026-07-22T10:11:44.634847Z","times_seen":4,"resource_available":false,"data":null}},"time_used":360,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":343,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/davinci-codex.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.821Z","timestamp":1784715070821,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/davinci-codex.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/davinci-codex.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvect1nc56n4r\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p%2BH3EXYyPMWESqcB7UVnGxdFTlvb89K1YhvpOy7BicvSei0zusWJfSqcgJ5XkHvwpBpoRTvCTf%2Fb%2BiRZeuVflR0%2Bu2lrhQTx0kS5KdRn0E3YQFKFZuHHH1J69LnQxQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e89bedb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29979,"size_decoded":30994,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"15fa0f394414b22a39c448325fdaac83","sha1":"4c541713699715c709a9d7ef0960ebe16277bcee","sha256":"1cf2c7f093a427f35055ab655130cd13d506155e6b8f9d69f1fbd9151f1936d2","sha512":"91da48b775111b6f7a7d65bb9040bf00334bc491c209bcb58050fd5f3003528d65ae594eef3b3588e6c5ef605b5165220f9ca7b9d6dddaddf9df8643715912af","ssdeep":"768:jZCuW8pdKP5GdB5DtSUr2cEFnd+5q0WsCRtVQw:rNpkYNg3cMgSRtN","tlshash":"5ed2e1f22f382dd1bc3f8dfcd12372e4c6b665954593412ea8b9947a13cc6d9981ac42","first_seen":"2026-07-22T10:07:06.315044Z","last_seen":"2026-07-22T10:11:44.635574Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/be_gamble_aware_icon.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.867Z","timestamp":1784715070867,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/be_gamble_aware_icon.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/be_gamble_aware_icon.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehizi35g20ob-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZrwQtKWOwiORXP4FDeNEdlzfHnFupHRhkPgP2qlnu%2FCgZ2rh%2Bivx9enxjoMsMSdeBLrl9pahSuCpYqFQcpIzJOZSKIqhI6Xl%2FQ4YbKbu7wXfnPoPM3GRZGeUeKJOvQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8ec1ab4f7-OSL\r\ncontent-length: 43518\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":94187,"size_decoded":44547,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cabf5a6798388bba301c4f11737e900b","sha1":"6520aa0b76e64af3352be583a6c132a9ff343f97","sha256":"f2dacdfb25093fb7aef311ca21f74029249de91e3a01281981a054982810e61f","sha512":"9087f527d73c4c2edcda872dfb7ff5e82997e757b6b218fc1428e23685779c44d6bfeed0bdda47680cc4ea13c37e275c9b35dfe79373f68033fd157703747d2a","ssdeep":"1536:vPN4zqNHCmLcT4rw1iXHu+H5+8omU0JeJcshTj/D:3N3NimLcMcEO+H5+8ogJ8BTj/D","tlshash":"e393102a1c5c6b4e33760daecb43243e6e8235eca29d85df389f75ecc2635509271da4","first_seen":"2025-09-23T10:56:20.472788Z","last_seen":"2026-08-09T10:37:17.217555Z","times_seen":61,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/fruit-million.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.444Z","timestamp":1784715092444,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/fruit-million.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/fruit-million.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\netag: \"dhcvecvyfhximph\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D%2Fsu4flsoX89jG%2Fe65LQEpJM5tknvsj0pRxpVi9MTEupMC9dW6gal8DVphMp4i%2BsZGTkL8fMY17dzaw%2B31FgZTxKamUUu0KU22FVtMtEuaAI6Q2RnQcmmeokFgDD8g%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a96fc85cb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29429,"size_decoded":30435,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"14617d4b0f1311fcebf6a226a212db42","sha1":"7cb1def53b69e338d606789a2803bc4e75bb6bf8","sha256":"961e33156bdeee290476cb9a7771ea779a4d3d5833d790b8126205c3be2e6d29","sha512":"5c8b9b9a7e67f16a404f04d26bcc918d59ab90e621adbe9e2ba20ced35fdb91d2c31f9f06558caf318815f4a798199604d4272b77b19a79a6b4e7e1da283fd4f","ssdeep":"768:TRwBRmZLccfpPWHwYhpSkVkplXOn0A49E8GxJ:TRy/cXESkVkrXOnM9/Gf","tlshash":"1bd2f146e8fa4553f61a42fe357e0a991c11e1ddba184b560dba62bc37030cdc7b11eb","first_seen":"2026-02-04T18:36:07.385521Z","last_seen":"2026-08-07T10:24:40.850953Z","times_seen":5,"resource_available":false,"data":null}},"time_used":385,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":319,"receive":66,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/show-me-the-honey.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:32.456Z","timestamp":1784715092456,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/show-me-the-honey.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/show-me-the-honey.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:32 GMT\r\netag: \"dhcved04gjo7lma\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NECP8xj0yRhy8VkLOt4Y2BHWYxOe9jmHkPiX7y8cLffEGEzlo%2BzuUn14wsMUTTQJ7c2RZgH5bOyzC32jlqBCPk1CFLNnjqW%2BD%2FlGeFiF0y1P2m1l3mXTHUDYYOGKeQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a96fd861b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28018,"size_decoded":29026,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"fd85ca61ccecf0866a4247ec11dc2eb7","sha1":"faf7c88bb5b90e314cc911d2f79365e275d6003c","sha256":"fd62575d1ef199b79ac6b7fe53077b12aabaa36e267ad5a4a0b1f05a49b14019","sha512":"85a83208a572121097e686d9eb0823aa18a38ee210be8c1abf73967c519d51957f6bac5275eff0c37e25e93e828214fae83db29b88f45fbbe854b9a279d202b7","ssdeep":"384:iYYdiw8kmJaFDff1bEU+5SBzKYCncrUt3UsMywDl/tnGrRnJY0gCVkuh93kIg:ijgvJoD1wIWnhGHyhXVkiR8","tlshash":"5dc2e1166f22ce68cb1cab7cc37647b327f51f276c9a2b5a223785ad13d99c1050ae41","first_seen":"2026-07-22T10:11:44.638636Z","last_seen":"2026-07-22T10:11:44.638636Z","times_seen":1,"resource_available":false,"data":null}},"time_used":169,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":148,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/tall-sally.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.830Z","timestamp":1784715070830,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/tall-sally.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/tall-sally.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecpo725t5lj\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CHko19CPOFuuz8mVQDOm%2BrF6meIf2WZ9vAj3PrkUWrDQMQqglOhH%2Fs4aBNPBB0hdsUd0vfzrbShwRtF8kdKhdnl1iwGS3KATOxUfFsrx17NZYTDSDzjK21KnDEKpWg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e8abf8b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7255,"size_decoded":8265,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"a918cdc61c631ac8678362c1eccc6d09","sha1":"8f25e8dc021ee176fc81e388e43c72b58238012a","sha256":"8f76c6c23fd7a260ffaaa47334834b5ea545699728ff9e25a9fbc1b566403f10","sha512":"b05d5fd8423f40271f9b29564bdbc4615497569a9d239bf6f7caa8822a48226f83025497e6a51a073d479db3564c793ff8bf250efcee5f222fc90c6506dfe8a9","ssdeep":"192:PdiYUy+GbyfByEfztC3FoA75N+ogXO7Qfm2s:ItJ3EEfW75NNgX5e2s","tlshash":"76e18ddf228b5461e57f05382b7247411ba1db62b6540ab36a943c1d6b709c4a2f2a24","first_seen":"2026-07-08T11:58:04.323041Z","last_seen":"2026-07-22T10:11:44.644077Z","times_seen":3,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/build/frontend/app.js","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.785Z","timestamp":1784715070785,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /build/frontend/app.js HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/build/frontend/app.js\r\ncontent-encoding: br\r\ncontent-type: text/javascript; charset=utf-8\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvgu9z3th6197e-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:58:57 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Tv1sMA2pfDeGWnOfmBpraJT%2FZHE%2BnnztEOFE3hItS58ZRbWZe1fE1T9bZCUsL6oTjCq7E1miy%2FgVdXdwnXthwsBKkBp0YJvib8SfmsVD2uRgaSmbovayKe04D4aoGA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a1f1a8e86bd5b4f7-OSL\r\ncontent-length: 8052\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":58586,"size_decoded":9093,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (58525)","md5":"614439f93859eb949774da21bb3b324c","sha1":"96fa5d909ba3a1c7bc55dce813707ff4ceadc68c","sha256":"8de78a081a5fbe1aea6edb6e4f26bf6d36e670a219ac50fb65723c02fa0c7065","sha512":"f05df3dce5b6a9b7c81d1d84035f31289ca915264cfe8effe1b68f2ca0f71fca11bc24aef62957c391002d470d744a1ff55cd5215a1058e98209e7e68a61bb03","ssdeep":"768:toC6iojJ7dLfn7aJBVawnwxw8H9bBws7blPaNdfPtnaaSReFA78iCKkKhHzLzan3:iiiB7NBhvCfPk978akWM78QOJ7mPbB","tlshash":"cd43c75cb38075324597a232425f920ab2767455208ac4ecb53ac8e5bef8c9d7273fbd","first_seen":"2026-02-02T10:45:14.569249Z","last_seen":"2026-08-07T10:24:40.801487Z","times_seen":26,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/fortunes-of-asgard.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.812Z","timestamp":1784715070812,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/fortunes-of-asgard.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/fortunes-of-asgard.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecvraaznpeb\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YKwA84CZNIEpQVXDd54OQPrCbsFfvVowVH6bLnTzxpdq7vfZBDKZ1DOjdo1H43Dy5trd8wkKtRcZpV7SHisq6L2VLgqn0MEVGn%2BmgCCxMwMGppgx1S%2BgZ3FBBmp6Gg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e88be5b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32915,"size_decoded":33931,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"0f61d6a7f35c5611c92ad8f9c1bac91f","sha1":"10a6171ff2a12e8d64d693bc68a93c3bafbe9453","sha256":"37eb4fa1e7c22a9f4d26f7e125446bb6b0a66a419abbf952ee8adb09975f636e","sha512":"35f44b3eef1ad57d05b4e7f0c3ab23f3f892712d60dabb082f112bd3dae08eb040986df7bd7977525f4804af6ca8364450d83fcf25ce7861f038a128a347b707","ssdeep":"384:iu1bKWnPuMYogo8rJesamQhI0s2PIWMbQvgOHe7A+RJedtFQyKVGL4OKhJV5+Fuj:59VXBYe35bsYDvgMGAWgdtaHSqJj+VR8","tlshash":"7ce2e11016588a829b7cd4f027cc1917fbe628e77881b9c1b2684ee45a7859f7b03ab5","first_seen":"2026-06-10T14:33:32.492977Z","last_seen":"2026-07-22T10:11:44.64565Z","times_seen":3,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/the-dark-knight-rises.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:18.413Z","timestamp":1784715078413,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/the-dark-knight-rises.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nCookie: bn_source=; bn_firstpage=https%3A%2F%2Frainbett.fr%2F; geo_country=us\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/the-dark-knight-rises.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:18 GMT\r\netag: \"dhcved146idegdj\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\npriority: u=5,i\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AT7%2BlJW3qeFrkEcMPcEyaBdjrLqY5qn8MLtauITQvNzWfLnW8l52BgVGhUxR1LgWIdfFKvbrGlojHfKq6%2FejvICxjvTEVzM9a8prWW0NjudC%2Fp9kdVH5jPXxxIKsTg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a9181d4ab4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21223,"size_decoded":22235,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 364x265, components 3","md5":"3e6b82c4ef57b9697b704cdcbb0cd5ab","sha1":"2536f49f96ba7b1a1e32c803d3b099d73e24772d","sha256":"2167eb90f08d3864ea2d0547c127e6f7b58c1ab0f7da37f327a2ae8488bd06b6","sha512":"58e9be69301fea410c4db106a62c4c129558a54cb090dcc9f752e89e3993f13a4e04ac8c43be8f287fabc855dc4b9d1a0425c0a75e90ce0a2f053ca5046fe13c","ssdeep":"384:3Dxs3bFlpJhDD/LgT3MrrqltAU4f3eGgsIriFOJHuRUIrqPX9hZ1a/q62pmv04:3q3bbpJhf/LgT8GAU4fRJshGohZ1a/qU","tlshash":"1092d0d9cf9b5726abbece3a6e041d102db1c400abdd4ca588a09e7d570a1a0d44b7f4","first_seen":"2026-06-28T15:18:42.562652Z","last_seen":"2026-07-22T10:11:44.646274Z","times_seen":2,"resource_available":false,"data":null}},"time_used":377,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":352,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/next-arrow.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.800Z","timestamp":1784715070800,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/next-arrow.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\npriority: u=5,i\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/next-arrow.svg\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d5ja0wp%2FR6LvVGmFRgvYjT%2FeVc7PU34%2BJ%2F%2Bmx7WAgxMiNWYCGc2udN9e%2B%2BBo5V6MuFHVI3HdVifD3il1%2BLz55oxPodsG3YKhRVngKls7vzKqeqLgF%2B2bojVH25xk6g%3D%3D\"}]}\r\nage: 292\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"dhcvehn35eku6t\"\r\ncf-ray: a1f1a8e87bddb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":245,"size_decoded":1170,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"059a19b3bd2964e622f6bcd07e993043","sha1":"03dea1a108357993beefdc6629ad794ff696360f","sha256":"6df08c0f113a37486ca85fb1e08414f69a42c3f1aa89089f0fca4d9d6a065065","sha512":"3e0ef09639d2f763e561b0614f6b7029bef7bd711e0ce9633234a903db292e1d5d5a98ad77dc5d7c7e89e763459935dc0e5699ac6f0289814966909798e2b82a","ssdeep":"","tlshash":"13d0a76653084e2cf2228a20f729733520e65193994c1454d5261e31695499f6c7f5dd","first_seen":"2025-09-23T10:56:20.418245Z","last_seen":"2026-08-09T10:37:17.222691Z","times_seen":106,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/sizzling-hot.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.809Z","timestamp":1784715070809,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/sizzling-hot.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/sizzling-hot.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcved06u9zhmoy\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q29h5pTIWSQS5%2FfM689RL8JuDWbn5t8t29AYGTO7EV9W73Hox1aTltUGgSBDytQ3S%2BpgCMuxCR9DN62z9UvAL7pB4hN0mi%2F3v09dmnhrxcACzn%2Bai4xfPVATgYLBzw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e88be3b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29410,"size_decoded":30424,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"433340eba90a5b34985e6e88d55f4dad","sha1":"5f4bd9e8521a3870f9cbfc0367f86ce923f9d8da","sha256":"163d60cf0049faebe107ea7f514f7bd93618629e775af453eaad3e96d1ce061c","sha512":"5b9ad5c8d2db63e5cb332a8d2ea38d9efd15ed70d50a8d7cc880e33ece3c7f4863cf536c82c314edead147c98b206bc7f061d71a67d9e55858984ca527967751","ssdeep":"384:5OXjldQHEHDPCm0uyERo2LOj/pArP9mobVmghu9Uq6BLgaOUvo+dv64nBPIQty:5ORdTTVHQpu9m4rE9GBE5Uvpy4nRIQty","tlshash":"cfd2e1420bac6268ef7e03bb2d33b45e016eed39802dadbb56c60925455d868f0ee4c5","first_seen":"2026-05-16T12:53:29.930962Z","last_seen":"2026-07-22T10:11:44.648193Z","times_seen":4,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/age-of-discovery.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.813Z","timestamp":1784715070813,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/age-of-discovery.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/age-of-discovery.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecqj5k8hrrc\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dsvXqOfbAzSilfRM4AgiJc9kjeNvXiKtf1XUvcCNHeZEPjfctG9BF9DpmQR2NDBHCc4I%2BMVtvxR4HVUOSKL9WC2ASuCW%2FeokqFwn0fE2NFuxDeRiFy12J8eiJnSTqQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e89be8b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":35976,"size_decoded":36990,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 362x272, components 3","md5":"3e4f17d34a5a81cecaf0903e8debf20c","sha1":"59b936192828120445c16b6cd1836c446016cdfa","sha256":"205e69d0d22abf5b7bcb23c44758fe5cfb0d24471e5296b3b4d65c694112fd4a","sha512":"5b206444c335aad95d2617c7c5c4ba2ec4aff8b395f081bf63e528edc0fb5f4f2b011602d8c16cb6608a0bfa22b3f1ac78dfb8cebd45e8acb3763d7b85f00e46","ssdeep":"768:L5TRwy5pCx0XEDq9KXyoIqtRos5b6e3rhgsz+yfn5/udDGGTts1IQB:t9wCCCXEm9KXyqtRogb6i+kn5/udDTMb","tlshash":"a7f2e12b3234c15ae2ec3b97e5dd0b39e0b191567e81016aa49461425ffdf21cac87ea","first_seen":"2026-02-02T10:45:14.613051Z","last_seen":"2026-07-28T17:21:57.980822Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/games/master-of-gold.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.819Z","timestamp":1784715070819,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/games/master-of-gold.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/games/master-of-gold.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecyc5t7mmn7\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pwBsUYpZ04QU9wrYq%2BXCLt8Z26tQ%2BYdkbIGhxdViWO9oIwga7OZRXOBik%2FNXV4147GkDyBP0fr%2FjBgxKDohzeo%2B%2BN8xQDDIXASb%2Fe5LOIKTodE9xn6pCguozVjE80Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e89bebb4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29347,"size_decoded":30369,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 360x260, components 3","md5":"6324fbc3133dc4255e602170d62cdc2e","sha1":"50183b6e0ff70338a84253eb6c874ade79f56ec4","sha256":"c15fc0d8d246800d22d1a5fcea8a37c97281f1fd7093590179beaa7008a635dd","sha512":"0d26a2e2fcbbaa265f6251d6e9b5194a7b40dffffbae7addcc1f1ce87e0ba7a42cb30468b01fbd2e930d372b67ad3829a461d2a1aa2559884da493d646bba5b3","ssdeep":"768:z0qYwzXZcbhKEu5aOS0BAPJXfZGbNhIaj9BY9+8yGNZ1:YqDpcbt2CSgJ4ZhIapBSHyG5","tlshash":"f7d2e08d36810ff8debf69f910491e99d8f118ca2b0d1e1b97b409c71f3689a9729781","first_seen":"2026-07-16T11:27:37.476799Z","last_seen":"2026-07-22T10:11:44.649352Z","times_seen":3,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/uploads/media/avatars/harley.jpg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.831Z","timestamp":1784715070831,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /uploads/media/avatars/harley.jpg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/uploads/media/avatars/harley.jpg\r\ncontent-encoding: gzip\r\ncontent-type: image/jpeg\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvecoey67h3ap\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:42 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nage: 292\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=17eQ89WHJ9OabisACRykgRebetIraxBDkWDXWz1D%2FlQXyKbT2YTamoBlfFCM8lYdH1RN3W4kyg9rerV%2BxFILBno9B8v2H2sJgq%2BH0jxM%2F2vp37KPkf%2FeHIqnUnVssw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1f1a8e8abf9b4f7-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4273,"size_decoded":5285,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 150x150, components 3","md5":"237883d8dcd3d1c1c2ad6b5730df2e98","sha1":"20354bc4a4dab86d63bf74cf0c48bd965862f21d","sha256":"7b34dfb9dffea024dcc293d953fc5f18eb7a34a1715e1a02410a69d0e9fdcf60","sha512":"b2bb0de3b23420937c3b388ca6fae52e9d7dc20eed367147f149837323eca0884361a71fe7b59de7da2bea39abcc44c14272c7a4b3ff39665a83bd60fd2ca029","ssdeep":"96:BzCrzCB+w5zHJwyGTmA8AV0vhOKKnfhiNFKIvKnmeMCfjVf:BurWpLzPAHzKKfhcAIvKmYF","tlshash":"56915daa296e1031f87dd5bc021e03b503411f48eae1ae57dd804f955f7d88e2ce6171","first_seen":"2025-12-21T23:52:24.792967Z","last_seen":"2026-07-23T01:03:05.592341Z","times_seen":7,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/play.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.836Z","timestamp":1784715070836,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/play.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/play.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehncobu01ir-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yN2eskggCTqZ690Nqi0%2BFTdhJVMIaLJbrTEzNJaAO9dOR4jp45Vq0dYGXC1HaNDF9ggkzDcS4l49Rxu4WTHQ9Y3QkDE37%2B%2Bl%2FfFHM5blWgvhWQ9u1f19pLj0eA1Lrw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8bbfdb4f7-OSL\r\ncontent-length: 893\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1971,"size_decoded":1905,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1652dc836e9e756a570c40ae6c0a5bbc","sha1":"6d2243b6a0fa4bd2a61b12bf08968e3dcc5e6775","sha256":"e989bbb6613f7d37d8a9504c1c0a38a8a77dd884d8f61e583266413e786f3e35","sha512":"a106fe98dfead7d3bc32a965e2da47303c92e67e12300b8b6ecefde092f8137f40dd01e2fdcc3fe2bdf4ff0a70b79635b67a75a0d52fb9ce31a5a944c2d6852e","ssdeep":"","tlshash":"344143e113dd3158b582a7fd512bbc3a36020cc729168a78759818ebecc28ec8df0d67","first_seen":"2025-09-23T10:56:20.442963Z","last_seen":"2026-08-09T10:37:17.228243Z","times_seen":45,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbett.fr/svg/games/table-icon-0.svg","fqdn":"rainbett.fr","domain":"rainbett.fr","tld":"fr"},"ip":{"addr":"104.21.43.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbett.fr/","date":"2026-07-22T10:11:10.839Z","timestamp":1784715070839,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbett.fr","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 21:54:37 GMT","end":"Mon, 19 Oct 2026 21:54:36 GMT"},"fingerprint":{"sha1":"5B:5E:DA:14:32:1B:4C:43:14:1C:14:57:7D:72:31:5D:6D:87:56:20","sha256":"90:33:DD:C6:7F:D9:10:B1:DA:53:84:20:FF:E6:CC:68:06:F0:57:9E:0C:5F:8A:4C:F9:19:77:32:B2:97:ED:B1"}}},"request":{"raw":"GET /svg/games/table-icon-0.svg HTTP/1.1\r\nHost: rainbett.fr\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbett.fr/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: max-age=14400\r\ncache-status: Souin; fwd=uri-miss; stored; key=GET-http-rainbett.fr-/svg/games/table-icon-0.svg\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ndate: Wed, 22 Jul 2026 10:11:10 GMT\r\netag: \"dhcvehjbeqpu1bg-br\"\r\nlast-modified: Thu, 26 Mar 2026 16:55:52 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\nage: 292\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h1HE5q1MKKLn%2BXnjfirFtqeaP%2Fhy7x%2BBKR6UhvHEcXUQczyD7hMxtGpd5okhT7bhqdMjaemDwB0bn60uXrAotRrVvEeR8nawaLECcota4JsRoblILHVu6aoY5WkYFw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a1f1a8e8bbffb4f7-OSL\r\ncontent-length: 713\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1708,"size_decoded":1737,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"aa320b6007f49925b128402df3ed2b3e","sha1":"d4905d93611121b3de96c8974fc6f723f5c53a12","sha256":"28e7fa0d8ddf5a3d49cf6766a8fe272dd4a382c3d3e35c0ff0fc88ae1d889a69","sha512":"d4b5a64ce4f96a76ccf7076574431ff4650e79bac7c22d53406000e83ff9b61820386084ec2bfea29b59d850f3e27e99b7f83d166c1ef5464b684ac498d449d1","ssdeep":"","tlshash":"6e3152fc33dcc5d4550be3d0d335180a797b38f96f9ae65d80e50914eb141ac4ad8884","first_seen":"2025-09-23T10:56:20.277213Z","last_seen":"2026-08-09T10:37:17.212155Z","times_seen":81,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbett.fr","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}