{"report_id":"655443e1-c427-43f3-b460-ba5dd9d3b055","version":0,"status":"done","tags":[],"date":"2026-07-22T10:36:15Z","url":{"schema":"http","addr":"rainbetromania.com","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"rainbetromania.com/","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"title":"Rainbet Romania - Cazinou Online cu Oferte Exclusiviste","dom":{"size":53366,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1408)","md5":"604d27a7cbe5c0b1582b9e78dbe7d56f","sha1":"af3047a9ebfc54693effd1f4874022e9a32cf9d9","sha256":"147aa5b3279656c5a3376fad8aebd5b3a4728169d374f90ef7795e8d84794a24","sha512":"2b177da669411f2dc6a5e3f4d078becd17b0071881433d83503f7e3ba9aa43735cda1fd7fd8fb1cdb5034ef447a22af682206b32f401dbf507d943348d816096","ssdeep":"192:gx6i6tIElBWHkOOZHOaDM8kOrQc2BkL1vCrzFt+7JfkJfUG2oGjjnbWkL/Hy19mN:gxAOOVOMM8aSRgtPfMjFP7Rwb/dCWE","tlshash":"1633a832a0f5542313e3d591d92a2f0fbe80801fd51b9a91739c8bafafc5e418d6369d","dom_hash":"domhashfa2932f75b492dd1faf12b45a02205ef","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rainbetromania.com","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-26T10:36:15Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"rainbetromania.com","ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-02-27","domain_rank":0,"first_seen":"2026-07-22T10:31:04.36527Z","last_seen":"2026-07-22T10:31:04.36527Z","alert_count":234,"request_count":78,"received_data":1497620,"sent_data":40187,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Twenty Twenty-Four","description":"Twenty Twenty-Four is the default WordPress theme for 2024.","website":"https://wordpress.org/themes/twentytwentyfour","common_platform_enumeration":"","icon":"WordPress.svg","categories":["WordPress themes"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rainbetromania.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-22T13:24:20.352296Z","times_seen":403550,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/themes/twentytwentyfour/script.js","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"af4669e0681b3231857d5f0290686801","sha1":"cfb72428b32aea423d698da0583a5a68da19be97","sha256":"10439e0df73ab5e9703ad5fe012d419e7db8a37d63031cb6da1e3e779f311fbd","sha512":"e0222bdc64b48387e7167ee9e1bfca32491ec1303d72bfe9dc8496afa8d065c9d5dc29620ff374dd9ca093451247381c7d455fdb114dfd63dff2a1eb0a9b9ad1","ssdeep":"","tlshash":"9c113828357a55b22137b29b67cf86d5322020cbe445da863d7c8a862f91ca504f0bde","size":1071,"data":"","first_seen":"2026-07-22T10:31:08.024447Z","last_seen":"2026-07-22T10:36:17.04857Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/7a3470a8001ff517.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.793Z","timestamp":1784716547793,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/7a3470a8001ff517.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5iohMsCzITGEmNL6cWlHPCgatnbkXk9w7Jbsr1rUxZBvQgwKlF8tr5yO6mbISkghp5gVxEWdsuuP5R0LaBB0QZkzqgKNsf8YhdPDsheUlpBbsztDASFmWZfEnb1lfOl9ZRYq5Vw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"f5ce075ec6757cbf54ff40ed632262f9\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7bded1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 26132\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26132,"size_decoded":26940,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"a29cac72ae4520e7c98bb3065a72f6c0","sha1":"bf03f671b834db8a8a9e19d5eb1c9220dcf66f58","sha256":"1490d5de6ef366b7d80ba4bcb9799b6efe2b871dc9590e1d51c235ce01663f7c","sha512":"922bbdd55d377fdea031dfe1349f605adc221c78ebfa624fa4c253ca459491e7fedfbba808ceda456942b2ebf037e9f361edc49b03dfee545b0ff368dcdfed8f","ssdeep":"768:kDTIUwozJ095iRTNoEd89D7rqbOLfa4PdSf:kXIUwKLJurAczdk","tlshash":"34c2e112b25030ab3ddc7c9046a208143df2da3dd5914f9ef376d88aa60e6c4dc3935e","first_seen":"2025-10-12T07:48:56.684326Z","last_seen":"2026-07-22T10:43:47.540632Z","times_seen":67,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/690bc0e352c0d2fc.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.808Z","timestamp":1784716547808,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/690bc0e352c0d2fc.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wCTv3rQLLIpzTpib9iemqvgdCk8yonztFRrSmSDs5P0dZQ0lwBNG8tBi0oKwIcuZGND358zzBOSsYTCkYMlFYkzF9LVptjDBVSGT%2FUpGuZaKceemUs5z5DuXotDfDkvnyu8mM90%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"8c7efbac99604082c396fe904380207a\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7cdf91a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 20085\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20085,"size_decoded":20895,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"843e7ebe7ae17cc10b217375329e6b6e","sha1":"c9af7f7b6cdae180879300fe0082fa4f0a60cb1e","sha256":"04730aa6b3992201bd4a7bc814c13ce6e2c0284fd9e9b72e2cc26a6bf848c249","sha512":"7bf7aa0f53c071422f0ec81016152dcb0bca6d6e3a9e87aeb07801e2db3975978330b3a0c458cdb9f84d8d0a2d5cc1778348ef3d7c7cb1fe5caa10955c38e66b","ssdeep":"384:u7Jvi24+5ngrahcAICsgp+PLXUCKpbeuRXSAM7X91cZvwYdksfQBF:u7p1XNge7p+gCKEUSj/Od5oT","tlshash":"e092bfee3fe096817c366e7d83916204f4e2b8ddc18e48538b3586138edd9c437252d9","first_seen":"2025-10-12T07:48:56.639825Z","last_seen":"2026-07-22T10:43:47.567604Z","times_seen":67,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/710e8ef81f8fac66.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.826Z","timestamp":1784716547826,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/710e8ef81f8fac66.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4G%2Fp57%2BZ2QfBQm339tvjHGRzeo9E5r71pQba%2F9cWMkOvyvS%2BOB8xC8GG9rjp%2Fur9R7c%2Bgqmpkg4Hg7H30whIvtuywgjoIBuueRGwcKQcyQo3csKUYRlRkdv9tDgEw3YiK2JzJcU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"9a14c7240c42d1939687214817584f6c\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7ee091a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19439\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19439,"size_decoded":20259,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"99b163a258ac48343d78700d6ea72dc5","sha1":"07aa77cbd1aea360470fee6fe856e3959cfd5040","sha256":"75bf3f0e7e125648a2b520050637766af0991d45137176a817351410c8a6f2aa","sha512":"05bcbb1216dcb382de98541e11dded74c178571aadf5db7a9401b1303e38ebd45a4f07ba3444173bc7a672696daa1539768a8978e22aa5fe25eb6babae92eadd","ssdeep":"384:3t+0mPOfywn6aUNN4y4mNB5aQMa2RywITq2cXqbinjMJR3/qrRpLmnUvMJ9RbV3:3k05fywn6zp4mH5aQMYw+q2c6bij8RCI","tlshash":"2892d0c6db708b1cb20a4e37a69db41c8f648f106ae50b17137ec42d136a4d56d65f4d","first_seen":"2025-10-12T07:48:56.701589Z","last_seen":"2026-07-22T10:43:47.568469Z","times_seen":67,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/a8da36169d252a45.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.828Z","timestamp":1784716547828,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/a8da36169d252a45.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ggv2d863DYlVYHSPX7VHxP5EiJp%2FGVSRENwoax%2B5VJnJPequv2jpEGecEa8mJl88%2BMYjWYAxzgioRHWgMstbmoVpzGvtkvmG%2FyGBZEkWbn4Rpw%2Fn%2B3mc3qX2VYwdfrLZTYdY%2Fek%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"0fadb21f0bbd665cb41d069f4c4eca68\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7ee0b1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 21767\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21767,"size_decoded":22589,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"7772a6bd94a7cb81bfddfaba0e1c9d55","sha1":"d9cafc4f80e1e7ae24cd149e2200aa9ec937f661","sha256":"424f0a2a42f5c954db2dd8e7e550b4f13f134183a5b0edb0442a722c04ddc5c2","sha512":"129fad282e84dab4f88538510bec2bf4817247a8728c2dade6ed35a6fb6c242bf6e555491fa8d056be04d34fca17cbd5b453468019a0471f25939b3907290755","ssdeep":"384:Dgvm6O6Wljl9vksp7yQyrKfPH1RP8nj5hzrq1uC1IU3klYOLYjwSQd:Dgvm6alxkshNG21RmfrWuC1IUskwSu","tlshash":"dca2d094ce5805bd70768c3b2d3982357c3aa96386de9353a471dc0f8265f89e9824bf","first_seen":"2025-10-12T07:48:56.603556Z","last_seen":"2026-07-22T10:43:47.549719Z","times_seen":67,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/3f273b75a6853c66.png","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.836Z","timestamp":1784716547836,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/3f273b75a6853c66.png HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XM45Bidu4EHJEYXPweW%2FDg3LB5ykYg%2BFEPy2EH%2BQ9vR2IbkH7jbWYUGj5%2B4iqowWFlCIVPUd62AaLul0QPBELEKDrvYCVcd3mh3OvMI7PMyEwbMWLT1TRtv4AWBZuXD7wrd%2BEBw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"b743a4fc3f79d3d9726e8c97796da638\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7fe111a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2070\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2070,"size_decoded":2886,"mime_type":"image/png","magic":"PNG image data, 200 x 29, 8-bit/color RGBA, non-interlaced","md5":"d2ec76eb63497a3be6c84d76342f7c8e","sha1":"22dec907b7dabe554c2cfb824a3fbfb06412e33c","sha256":"8a0a1981ce492013306885e7243bf162d403736313dc55e2df283cd00007be76","sha512":"a69a9a1ca455f541cf6a1085866341c0979a28b4d26cd5c7c5591ad9845ee2c03adcc83aec086a48a7e39d35bdfb86b0ab98fe7856dae9698dd09a0a85597f8f","ssdeep":"","tlshash":"ce41f8da2a10acf53c69c6399d54baf19512562fd58fdceeff1531380b09106cd74822","first_seen":"2025-10-12T07:48:56.63266Z","last_seen":"2026-07-22T10:43:47.559779Z","times_seen":65,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/0427fd9d99693d27.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.947Z","timestamp":1784716547947,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/0427fd9d99693d27.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nWuVQ8r0OW6yaRS2wc1W44cPM55QkXhyWF%2BmJ93BTe2yEsBnTy5AzljJWrx3GBRPZRrnoqOk4K%2BFrizZbz5snb%2BpTUEQw8OqdoRNW7o3FkSMIL5Umgxnavmh%2FyTxngP3vSpGQVo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ae291a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6771,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/75b755ede3d7aa44.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.984Z","timestamp":1784716547984,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/75b755ede3d7aa44.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jUGMJNqqvwfqV3G5YmC3Y033pq3fszHTp%2BjTy1uEGhc61SvyFUJhnXhsMPGF6HyIuR6beLW08pNvFehHaf4y2G08hlz%2BrJo9J43ZHaJRcWf4EGK58YM6sMZ5aBCs6t%2BG7lgjyQ8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ee4d1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6769,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.785Z","timestamp":1784716547785,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript\r\nexpires: Fri, 24 Jul 2026 10:35:47 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=T4tbvnBjWYNmpAcZEVcTmjdojWZGD4lCV%2FbbVWY63ewoer9JP%2Fg7G%2BxKk9ePdDXcKihhKoFXuWEslq0jXof98zhZ3deNzqRTBQ8tTxT3vPyFUkezdvAR6HebZ2RTpXjXvqd0ae4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\nserver: cloudflare\r\ncf-ray: a1f1ccf7adea1a30-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":1242,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-22T13:24:20.352296Z","times_seen":403550,"resource_available":true,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/b84cca7150700aaf.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.825Z","timestamp":1784716547825,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/b84cca7150700aaf.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9%2FIWpgNCEr0vEuOXMSYcj7SiiVDqH4%2BqOYC37pFPlJpvIk%2FUqiI%2F7xVW4NK%2Fu4pizqSV6cqkcHAIZj1MOh7hcq%2B29H%2Bk4MAgrulV05aAVCXxVc9sUYTpgrKthn2fkwUT3ULkIxg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"34396c4a7f454141a11a7019e3cacf6c\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7ee081a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 23065\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23065,"size_decoded":23887,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"e807f953f4d2f99b691d0432df9083b8","sha1":"d81228ed1a0954f84a077cb3e15c8927d0739ee5","sha256":"f2e40e082aa57cf53602d9ab943c4194e0dc7771f55cc89a3e74d21bb372c16a","sha512":"0faf8d4580dbe08422e0aaad3b4058e10b28e283e9ed954cb1163162cfce42985ee47fbf9be597850a4d96b5304dffc210bdf21a8ba78ca809044b1e302059a9","ssdeep":"384:mPUjURMwdcs7w1aFG6IYUK6oF6YmQZ8zFjmEopWZuxakmcwLLuunyKbpi3VSMs:mP4UuA7YaZUKJFXXERkWZuILuun3D","tlshash":"85a2e193f3595d49f0bc5e3d777a86b2d58616ea896c89f3117fc724433a3d2008611e","first_seen":"2025-10-12T07:48:56.595435Z","last_seen":"2026-07-22T10:43:47.562215Z","times_seen":67,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/fc236894968c586b.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.968Z","timestamp":1784716547968,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/fc236894968c586b.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HDsbE4l3uFe9mxKPMZqDkJxXEykDS6cIUOTR15DCn7xSk2FgDsbNfN93gXgDipGxdPklef2IJe8iQs8%2BipcgN7cfF%2FWoja1lFnhQrJAk8Q64qL1b4FIWHYM6uB57ejQ9qX0Rn5s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ce3f1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6767,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/7be268e819c77e2b.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.992Z","timestamp":1784716547992,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/7be268e819c77e2b.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=knS8IhNIp2wbJfNCXj7FYoWCtjvkqn%2FJK4Z5JM6Rf62TPCSl5MHCDjwL6B3s89uEV1Qcjp78DBgFwiT5jmnzjXallamSez%2BLKpbmdquZkMUnWUollQ74QFcr2HwYLr7mpEOq8DY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:48 GMT\r\ncf-ray: a1f1ccf8fe531a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6767,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/favicon/favicon-512x512.png","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:48.074Z","timestamp":1784716548074,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /favicon/favicon-512x512.png HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e87Z1VK51zippwCC6%2FtrrgcoBJUqV7c9SJn5ANSQrzkBpkW6L28B5eotu97JjkEn56cHmjNFNVrWLp%2F9sbQRlMFjvVnkn1EamaHwBZledjnqQTlJymtg1FIPV7bcxLXM1php8Po%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"1717b92b4f4a0aa56374ae6fc307af47\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=6,i=?0\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:48 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf97e681a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 143729\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":143729,"size_decoded":144544,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGB, non-interlaced","md5":"9b040ee77aaa251d8e74b483292999d1","sha1":"0786f1c27cb2e7debc0853fd75229f2eeabe15e3","sha256":"af0f74b6c2139b506e03c5fc15753e955b9e6de9f958abd4361994932f4a4aed","sha512":"7efe243b576dc80dbe98146e72c550895ed1de4d7787156739fe7ed6a2916c275723b765e53d6c3bf7c3059a86da413b059d8ef4dc00d3e8680858b4e4c89dee","ssdeep":"3072:uty1gTu/wIsUEopdy1/G/JfPIIC6sIJhMaN08rm375UlCATN0p/UpY+:uygT2Xtzyk/9PIMsIJhbNbmlUlCoap/y","tlshash":"74e3128ff7660628b6cf1ebb5cc283d3681250c4999d867fdd0acf53a80c7558b9096a","first_seen":"2026-07-22T10:31:08.011298Z","last_seen":"2026-07-22T10:36:17.045295Z","times_seen":2,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/b72ba003d4457ea2.png","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.835Z","timestamp":1784716547835,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/b72ba003d4457ea2.png HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QNyHqykE84dvUwIL%2B7pUGNUmSp3d4QJyYX7CEpAGxDcu6ElGD%2BoS%2BVzi%2BpkW4XMWKgfp4lKf%2FGB5WMkvG1IML5xG052HSHydWxydAtVY74PmKXule5SLnXCTshB2CXPP9VHt7oU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"1eb33195bc50f0eea856c28b67291759\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7fe101a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2428\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2428,"size_decoded":3244,"mime_type":"image/png","magic":"PNG image data, 142 x 27, 8-bit/color RGBA, non-interlaced","md5":"543f0f26c7990d1ced7d1703055457ea","sha1":"b84072f09b2ecc9008e36f80b49733d1a7a783bc","sha256":"d9ece0796556b71b5265008cb2e76dbcfe6df67c3ae0f18ed6c9cf8c8a66f8eb","sha512":"85b9aa85924dec653e2ca2580c0b9862a2a897f3077529bb75bfb13c066cf9e1912131ae42292b814b4fd4c13f974b1aea821d87efa5acf4907e05a2a0e391b2","ssdeep":"","tlshash":"a4413d4b359ff1b1ab64973073567420a42397db1306796c65ba4d0710791767ca0b31","first_seen":"2025-10-12T07:48:56.723836Z","last_seen":"2026-07-22T10:43:47.571421Z","times_seen":65,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/5da8794e5a202187.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.945Z","timestamp":1784716547945,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/5da8794e5a202187.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IxwWRQCAI0paQ4wWe9kNXH%2BJiH6%2BH9lERlXglOJVTPggJIzKcrULahVfCMLcDfhoQ0bTfBPAMWw%2FxvS8ORcQhao5%2BwyZ%2FPxCq%2FfEXSd4Jk0DJQkx1d5VNZw5zgQ%2Bs%2BZRAsKwG%2BA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ae281a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6781,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/dbfb20faaf621a08.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.954Z","timestamp":1784716547954,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/dbfb20faaf621a08.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w71grAcn58iN4wRxSFXS1d0cDSieAyOT1JvMTddt3MFi%2BlM0LxwTdLSvIcZ%2BPRjDQRdC0sSEqTYQGbYjXbNswkU87EM%2ByM0fEq4R8pqg%2Fi0LZfdQKsQjwx9sbHJUVVVzWt4de3Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8be301a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6771,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/8a415c062197942a.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.990Z","timestamp":1784716547990,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/8a415c062197942a.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ES%2BF%2BoBlnjEpB4G3KpTUmjbf7bCcWNX08Y2uyfVerSNMhl5GxLSzB%2BoHyxaQ8WEDIPdM1ub08lrZvp4Fc0a%2B8QwvLc2ZVLkwWk0GwP5y6HOcxkV3J9C6KXJpH%2BpTBAo%2FSFrOQrg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ee511a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6775,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/ea0959c9bbeda603.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.991Z","timestamp":1784716547991,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/ea0959c9bbeda603.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=t1vBvYIglPrKBSsXtx2DY%2BUieuSOSHgNx9HTykTpWnMJhY4bkpr6Rn9OxiKH5FsBReicFuUp%2FNcLzqTO6Q3yBukmtcLM%2BkA2c9P9I%2BECfZo3uc%2Fm%2FNO1GrwsFX3lkHd5UKao3IM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ee521a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6775,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/59f4a3553d8d06e8.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.805Z","timestamp":1784716547805,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/59f4a3553d8d06e8.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OxDayD%2BACWD65%2BPUetHtsoIEQ5SoJzEcH0mvz8%2FLltgJ97JmlWk19jUfFbwEgcnrQX4tHEjCKTkNnk6yF3WViYyuCsnEFCNeGiiP8s2pVYloSDKvU14ffLqA3niOlLkYw0aDzl0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"50326008a5df9a4c43a6be8cfb9be2b5\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7cdf71a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19260\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19260,"size_decoded":20074,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"82da36d1ce860447b0c64e1f74db130d","sha1":"a798edb734fd4af73aee64cf8e4d5c24f2347507","sha256":"076e5be93589f4f87987aab6b4b1330779a5ee8eb2d446a34957f4fce33455e6","sha512":"cb0f15b4a741fe5c51a83ebba57853fc65ad67d8eb2a0a55c63899252e7b0d35e2534e59f6c22bda8e0b52d6cfde7adf372d08a3425a7e852ada1d957ccc5433","ssdeep":"384:RY1RLujg6+ioob66qhFravZHTJl3n9MmtXa+E4ioZzcK:uzLgg6jLqHravZTv39MxE9ZAK","tlshash":"c482d0b210c07f27f35c9ebeb7a8c87787e347295786b3876239de9292850c78848345","first_seen":"2025-10-12T07:48:56.620089Z","last_seen":"2026-07-22T10:43:47.548514Z","times_seen":67,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/d99de1d4657a5da9.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.830Z","timestamp":1784716547830,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/d99de1d4657a5da9.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F56jy10QgiYAYxTDtmHK3vpBNxMD2MkQh7T59IIs6mBTbpNJZzv15xPr%2BJedBVORv0WXq%2BPhuvYFTs%2FKEAsyF4zxwHSEgvZitF2H3aWqaZxD1vQAyssFk4cA%2BEjF8fv%2BrBWCK3M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"aa1f79e7536d4c3171d2426d91bc951c\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7ee0c1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 24141\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24141,"size_decoded":24961,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"342238a10199f5584fe84850dd98b10a","sha1":"09a3641d178817003cc352974e4247683278ab0b","sha256":"e9e3e2b78902b7d98e95276a7a13ffad1cb72fd7f029b71a03a202c78651af42","sha512":"daedabab0980afcbdebf5a6639f8433dc5587a4814b7f15e2cd84562b08cd9162af1d85cf81e9e75461954920c78f934c81e326b0517b594a41642395e09e1ed","ssdeep":"384:lM9HVO2aqhb3cocBGa7VgNSxZKADqcoAvVaS6ujWR+LNyVaB7OZiblkmk+8VHMJU:l+Zt7a7VgkxBMWacjWYZFSiFk+R11NNe","tlshash":"29b2f172401811f9a29a7dea64ef9b541f335c83241f0869bab7e879103c2ca67cd1d2","first_seen":"2025-10-12T07:48:56.759175Z","last_seen":"2026-07-22T10:43:47.557145Z","times_seen":67,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/fee9710c5553b3f2.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.952Z","timestamp":1784716547952,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/fee9710c5553b3f2.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=E5TVfn%2B6DKrdJ4aN6KkdeefVs3VsBN9zIyKPcOP0h3hrpaHA%2Fyq4omZsbURBJD%2BHQA41dqF45JJIlfexPL6GgkL6MURWc%2BVaI4I6l2phSXRx4BXRLamjv9Vwz5LKziZVg32OVsw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ae2e1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6771,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/f28ebc3691ae17b0.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.962Z","timestamp":1784716547962,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/f28ebc3691ae17b0.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bx4gorpHJSDX23YnLdhkkMXWu41tQoP6YvQCE%2BGFR13PGuxJFKizBcTsk3uJJkjubAlUDxUpMvb8EYTPfr%2FcOQM1KjJTHi8LJhrqggEpMj11EteB12Tk2979GtFUQDKq2fv1OrU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8be3a1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6767,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/themes/twentytwentyfour/script.js","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.774Z","timestamp":1784716547774,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/themes/twentytwentyfour/script.js HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FcR2S2b8iLKH8yOneMNj0Q3IQfEsc7eaDXOoIKyIP%2FYchDH4OXxqZ9Qtg4KueBF0jES%2BYKUE3UQof6SwNZ8YnzQD9udnsOSYIrS%2BqIVB9NIhx2nxLa7OqRkUyz5shHETrLspebM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: application/javascript\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"3475e7442239a75850c6cafce0ada0ca\"\r\ncontent-encoding: br\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf79de91a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1071,"size_decoded":1235,"mime_type":"application/javascript","magic":"ASCII text","md5":"af4669e0681b3231857d5f0290686801","sha1":"cfb72428b32aea423d698da0583a5a68da19be97","sha256":"10439e0df73ab5e9703ad5fe012d419e7db8a37d63031cb6da1e3e779f311fbd","sha512":"e0222bdc64b48387e7167ee9e1bfca32491ec1303d72bfe9dc8496afa8d065c9d5dc29620ff374dd9ca093451247381c7d455fdb114dfd63dff2a1eb0a9b9ad1","ssdeep":"","tlshash":"9c113828357a55b22137b29b67cf86d5322020cbe445da863d7c8a862f91ca504f0bde","first_seen":"2026-07-22T10:31:08.024447Z","last_seen":"2026-07-22T10:36:17.04857Z","times_seen":2,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/cd20c2863aed3966.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.821Z","timestamp":1784716547821,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/cd20c2863aed3966.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=u4G2w7TAPKBWtFpT4ATORVYrvSWP%2FlsEBa%2FFfVhk1xFUpxHqyph2rCKZSjvBjKW%2FzH78vYgmw6XaNNrMd5aaQ%2F3P0CqH4b6i4P0l1pzfw%2FmYQz3wIVlQscMk6El6jQdxI5ucCTE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"f125bd93b869a14c11d148d2a42afee4\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7de031a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 21778\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21778,"size_decoded":22596,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"730b2d8168e5666da11f10561fa2727f","sha1":"5bcf4a2b9d87af29865764b13a1e3825851c4388","sha256":"2be30e062ae7482f87c8d50cc6568df7ad3c4cb247b1550b35bf8292837678c6","sha512":"ba5f47ddee27e0f818f21117e9faa61e98422412ab568873c36b0edcdc6ac31775677f83252f2fe40e5f07d647f128b2c1c2ded8a6db9a6dcf6c6a96b9ab3f72","ssdeep":"384:HF2AYV8ULedv1+k4OrxOl6AjmPwqYVxjMP3Zs4gJnukoVKca2lbYgXkaWdQpsvXf:EAQ4J1+KxOMAiPUxIP3oPCKcNboaWcsn","tlshash":"fca2e1d9a7a2d7c2e3a19ce5688d1e2a00506c18265f793c50b1cc2e95743eb92e0f7c","first_seen":"2025-10-12T07:48:56.698277Z","last_seen":"2026-07-22T10:43:47.541491Z","times_seen":67,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/87c277f578e1f11f.png","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.834Z","timestamp":1784716547834,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/87c277f578e1f11f.png HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CD2ExzBhJ2bqbQ0I0EOtlIrbwSLUQwY6O4cfwlpBejVFAigpGE9eEhime6TmeknLMDJoEIcSHsz%2F9PJ2mO0cG6dIuky1PQYczYuMtLltvhmTTtutpkswsshlE69sCEV5IRodY74%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"7e8d787195ea19d705523ab62982362c\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7fe0f1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1773\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1773,"size_decoded":2581,"mime_type":"image/png","magic":"PNG image data, 142 x 41, 8-bit/color RGBA, non-interlaced","md5":"38de1c961a07b8775a1f371394823f5d","sha1":"d5641b182fdc34a993832ccb5bbca86f07d84c7c","sha256":"6d2ac0ff0c7768d59ab47eee3383fb917c81279f5f5e6dfe2360e5c3b42e52b3","sha512":"487fec2f394e354b5e9a4860cdc5a7a58dcccb5d3b8cb5ba7b049be8a2ff082b9b1025984a9fc43bc7d9f4c078342b989b4296d2327cbc77db9f84cca1f1f847","ssdeep":"","tlshash":"98312bd297898137891f53c6be8fc396fd4cc42668af4d216e46bc26053281cc7246fd","first_seen":"2025-10-12T07:48:56.616835Z","last_seen":"2026-07-22T10:43:47.547614Z","times_seen":65,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/dd83a184e1e10b50.png","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.837Z","timestamp":1784716547837,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/dd83a184e1e10b50.png HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3rkkM2gcYBcCRTUUB6NGoCLzcTimU5zyGVwwYbSEjrql%2BKsZl%2FWyjp1qRf94gwawtAMzgbtK%2B6%2BeE5yGO0VaQLRK5mrWTuQRg4UZnGt4oxyq4xlg30EYYhy4jWR23%2BPTTEimfXM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"7fd4547a3c9d59afaf332063de29e0d0\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7fe121a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1834\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1834,"size_decoded":2650,"mime_type":"image/png","magic":"PNG image data, 112 x 53, 8-bit/color RGBA, non-interlaced","md5":"b0e3ac9ebab6af5f48091dfaff855a54","sha1":"096de8f22039486621f167862d3cdd2f7d6d6a6a","sha256":"fed91cc5540efbbafc70f90d761c9caf1855a43f9ac0abdf58b43020bf1fca76","sha512":"6383332e70343cc4f6be1510e793ff8416c9a1d2de0b6e255121026683a162cb12075e2e41f0074d0eac618390f884a5365716cd50c2a1842b0b2dfe2c7439dc","ssdeep":"","tlshash":"8731094ebb253d6f55fd6e3d47245434a43f98bf3454293ce87745085ea520f60075a3","first_seen":"2025-10-12T07:48:56.729773Z","last_seen":"2026-07-22T10:43:47.56061Z","times_seen":65,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/4ba72ebb8fde3bd5.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.957Z","timestamp":1784716547957,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/4ba72ebb8fde3bd5.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xXCW99ckYTh8tioQSK7i24gwpTU0G46JaaDXCNlbm2S8LQNsr6qjLdy12eeslKkvgIDMTsaKqGAAS05OqI%2FHPb%2B4K8DAkDybZXrN9kKMw8WmXH0V34NKsp%2BkhCx8cebVRIFRmeM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8be331a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6769,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/e32a358f4df96b07.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.961Z","timestamp":1784716547961,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/e32a358f4df96b07.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bGnju%2B1Bdea9PimujTFClK82MzWmrOXaP%2FK56hTQDpGmTHRo4mFg5df0%2FBbKuCHK%2FOnDqNCBjUGbXFF4yIpDty4QpPTciIKpPpMl%2FkXIo2zg6bsp4K3q4FdgTvH8uX64laH3zf8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8be391a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6773,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/e6cc3303fb184f58.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.985Z","timestamp":1784716547985,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/e6cc3303fb184f58.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FyhJDUqWB2sf0P0QHxF2UYBEXUb916qjhg5%2FUCMGHUVwVCO71VAwDP5dmxrYEgmwFvkSvbBN64N08pKh%2Bh5jWiVW2LQeyukBnx3eFUrhFotACdvajx0G2i03%2FKtuFQyBsry4uqQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ee4e1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6769,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/d5df27eae206cbfe.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.795Z","timestamp":1784716547795,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/d5df27eae206cbfe.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0Dg7QoThFD%2F9%2B0X2yG7oBwzL%2B37irA1q0c37vfAVetjbn59Khvh2sjkNDJJynkauJG%2F%2FYyFUbqpexMTetfhs0PwdSw%2BHGUZW%2FkPpP3Y0JWJlkAQTMtZNc9w6I9jzzFg0HG3Hsn4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"888147a23345d1f2c62c09c27345d708\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7bdee1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18686\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18686,"size_decoded":19508,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"1598d4e1397893afab65099adb8177cd","sha1":"06a9b9ea260d14a3996ac1173093c1041008232f","sha256":"bc95ea72facb19b3a2e791f7d453ad3f6ae26715093af849ea2e997f5568085c","sha512":"862f23761ecf4326be9ffe39a18fb5e1e84be9a44157d822b55b86af2c40adad481428fe2cad766cedfc390c4c57a40ae8898ada36c54fc95f596774264f404e","ssdeep":"384:0H5PdFpoFJYrnNZZbO8yd8cdVAxQ3qsB/cGnPv9FapRFG9f:SsGNTa802mq2cUVFPf","tlshash":"a782d019ca717f87f90acc755118724bd322b912b2d3cb16fbb1bf8914b81d51518c28","first_seen":"2025-10-12T07:48:56.587042Z","last_seen":"2026-07-22T10:43:47.546705Z","times_seen":67,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/0a697a59a9dc3096.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.802Z","timestamp":1784716547802,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/0a697a59a9dc3096.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tpsjpGGWEKEtAx%2BFgORWlqlXef3208wzVlTNBVUmRSaQrEO%2Bebch6CRGRXlgsLrvsNB5eVZQvMXWEvVcthoUPvS1ZUAltw1wI6Tpi%2Br1LqIH0SJ04uUrtTSkazygtFAbqsfZAF4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"f983595d6c3ad55cc64f7747ecd21f0c\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7bdf21a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 20677\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20677,"size_decoded":21491,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"b7ca976f7005f75e99b8864e76de6a99","sha1":"086103a1798abf487b80ea569d08126b610fe80a","sha256":"6ff52ff1573f92eca5873d04f10dda45a32c90d2fc38a1416eaba66711a16ce1","sha512":"236a47025de8ca904a6b70e1f5294f7322a25e0298e798cc7c58e293e83e774bf43b7427780edf4dd80d5d40aa3d5eb22be6513f683312a4199c145d220924b3","ssdeep":"384:H5svauSJL9pb8feVzwU2NSXFfQe3FZixXlyTneEufxzQz8QZFsJ:H5TpwW5h20FIeVwTweXJUIKFo","tlshash":"9892c0648d7f8111e59e0c3366b287ac2e197d478235abf7d038c9acf7d25cb166028a","first_seen":"2025-10-12T07:48:56.688486Z","last_seen":"2026-07-22T10:43:47.532394Z","times_seen":67,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/43ba0e95c6b5ef9d.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.827Z","timestamp":1784716547827,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/43ba0e95c6b5ef9d.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vUsZ1UKPW7hrRJX8HhvESD7yj7Hd34ixUNEY3nQlUQ2lFxwa0N5bCkoB%2BSHPNO7g8qnRs%2BONWeKwZvdpXCPwUXf%2BKpD%2F%2BwKs0%2F6IzUctAVWqEVJK%2BlkpvTQkLbI4223E4f8CYX0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"3d46b2a153e7fcbc36ea189de3689362\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7ee0a1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19273\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19273,"size_decoded":20095,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"e83e918323baaa0ec015a07220cfc8bc","sha1":"8598a4c6bc0203407f1075ae55df00ec2a71ab1a","sha256":"e0806f42619f031e872e4c6cb86aa6c0a50dbd5bc8f2eed49ed4e6ca93b430f9","sha512":"4eb83643fa9ba312dd4ade566f049bfa2f59b984a858cbe053b1e0f4036785e8ca28895f829ad73a10728f435e8a9b74817c33a63a1c38c4e7d120ea8a09c331","ssdeep":"384:l4cPgLBij8JGqhSd4qf7lyVWFZOqvATCTzg0NA/JpydL:rUsmXhSLDFZKCTzxNAhsL","tlshash":"ec82c0b0b3618e60d4ba5e768bfa079c3dc24b911f40a20fd918dc9014765e17b989eb","first_seen":"2025-10-12T07:48:56.626518Z","last_seen":"2026-07-22T10:43:47.536083Z","times_seen":67,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/4bc457b7987a4cdb.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.958Z","timestamp":1784716547958,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/4bc457b7987a4cdb.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZEw8pSfWhxFKxEFx%2FcRYXF2XQVydFP1%2F3b04hz81avmi6ZSdzz%2FKkDvPmFn7LWadOzgDv70lCPR0DGzn5lycXjfb2jcZ0zgEzNtoEyj7nIGPQk8VdnZnCu1nRyEQISCENZyQEIc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8be351a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6769,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/89c989e5ef03f854.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.959Z","timestamp":1784716547959,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/89c989e5ef03f854.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0MteVXIhriZrSO3zYGT2s83%2BvFY7LFekOhAGaX7XURkDsAli4Nc4Bazu1WX%2BnW9AJ5CWrjXIojC9e11HuAUkPgSx193FWt4GTS6z0AeddyiCzDHeRtY%2FeE6Hkqs9QLiCQLwN%2Fa4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8be361a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6771,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/1cbf55bbae80599f.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.997Z","timestamp":1784716547997,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/1cbf55bbae80599f.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p4aSMrKnew5ZOyvPpPmJ5oq349yHUvQMNVDQ2Y5pkx6bRVmphKHJ7VWAQ7up9acKlTcGDUD35c2m4CNfYScHY6rcIAZlydRN9o5smAhg5mEsciVDgRCzqcrKzY0ATTxAwZxxeIQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:48 GMT\r\ncf-ray: a1f1ccf8fe561a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6763,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/3f652a97d94075e0.webp","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.790Z","timestamp":1784716547790,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/3f652a97d94075e0.webp HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Tm%2BHSqjtL96LqNWD23Kzp3EvjsEvEZMhbVMFegnTYCQoThtZDcPyQnjn%2FBpnchtgsK7vJE1z7ORpjDnbSt1iKgZxwTJH1Qj5oF42EEUothkuPdGqNd%2FOKq9MBbEcWtLk%2B25LzNk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"2ec3f45305c3ecc356533716d616266e\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7adec1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 28656\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28656,"size_decoded":29472,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"be55db140f148ae5a084894ed8837302","sha1":"60b99d50435fed0f18e4e4e7db48424de912c0ab","sha256":"dae3573b384421ae8b1675e570fd0fa2df20e151c6cae6b32ae5264d22704eb1","sha512":"0473016f8c3f9627d0e64dd1f5a601ada8871b8492b9c431cfdf00045e21efff9d3b80ccf0913ae115462fa151d4f7800c5219e8bbf4b2475510d9e440914124","ssdeep":"384:FLMomIwhLYPvW2WccWJD5FI61rx8+xtR7ty1OLptcWUhIJ+A4K0+K:FLMo20GocWfI61rx/7/vdUhvLK0+K","tlshash":"c9d239a1c32908d5f243203275550258a337edd7bd38eb866702dcad97513aeaf399ec","first_seen":"2026-07-04T10:30:55.332064Z","last_seen":"2026-07-22T10:43:47.553146Z","times_seen":27,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/603539b3af21c77d.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.800Z","timestamp":1784716547800,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/603539b3af21c77d.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3QYCK7wDnXRUnoc1J%2BZGZTjQ4ssUUjYtawtvwUA2emjexUoyqCtK6sOZ1Kqn1FyuNXN2JXD9joWwlwyniPipbmXR1kGTVA%2Fx12T9W7GIXBNKNLaUXhId6Q8KddqZzNP56kHWJoI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"f210de80b19f1952c50a32222ab98305\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7bdf11a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19396\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19396,"size_decoded":20208,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"05576e9f1e9b78305874c7c6d7c6acf9","sha1":"b64623c3c7686107acf0df42b5553d2e7cfe46c1","sha256":"73c34250a6cb2e9bf17ce42b9b96f801a07dec40c17b2401451b386d52efe815","sha512":"dc2f953706f4f595378e5c9a05d7a35ee95756c9e0e39dbfa389521f0a763d1cba213a8100d8bce2fa2718c28f39379f9c40b4cc36e0b844b2c3a96b9377adce","ssdeep":"384:tMeguTTF8c1l8Ch9S80tgC6yRoiMWYnwlNRg5vE7Q8HMTrT:tMfsW6GCh50t5O0A5v9gMXT","tlshash":"eb92c08fe5124861f61d9de2c667b050231d9eb749d9729ef0bfcc4a013dce21771a45","first_seen":"2025-10-12T07:48:56.667107Z","last_seen":"2026-07-22T10:43:47.535166Z","times_seen":67,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/f03d5a654fa9a984.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.820Z","timestamp":1784716547820,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/f03d5a654fa9a984.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MXlLnxTCSUdB7xxalohah%2FkzSpkPutxOePjNKynuRRVsXuoq98pHwNonekDQ3KADXt8wmAwmQFt3uzP4QKEu%2B3Rb3L4dPgEJnLPMOz8IBwU3qfvqo3m4hBDQC4PrPGYh4%2FE%2FaD8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"079d4e097daf9bb343f614015a3e5347\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7de021a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18762\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18762,"size_decoded":19578,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"9e1c77727835922ee9e6a536d2101423","sha1":"1f48885be11d26e1e3f7f59ccaa8e3a1eac0a42b","sha256":"23986db5adf93a07e9027ee63619ab0ded8b64778bbc3766ba3426ab25c81ca6","sha512":"1d30eecb07843f20e8eaed38f220d7940e158463c107616a1ad8a0eb64eef5155d53b7eea129bb85c13f701f713bc25fa47f3555edf8ecdbefa0826e1f23e687","ssdeep":"384:GxKOBzBWEY/LYfkWxU0mQvLAq7HHfDK9dh7i3Hd6/9G:8hsX/LLW9vvxTQiHdQG","tlshash":"dc82e00abf49c145cf44af11e85f6c67abd9c2624228b3833274cd568ade5e10d98bca","first_seen":"2025-10-12T07:48:56.717608Z","last_seen":"2026-07-22T10:43:47.556208Z","times_seen":67,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/2b56e9f2181e87b7.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.824Z","timestamp":1784716547824,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/2b56e9f2181e87b7.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EVfgBmtXGRMsBL0htX9B7%2FM2wkYy4LFK6dKiLO0MEX%2B5c05fh92rKyAWra3UkDFBgFACnHD6hNSDIvbv9N4h0udnHmYFtn6fR8DQQQ4AjNuP29tLPlBUsIYnT3JBbfPZFolYPUo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"0184b3be48f5c12035574e2cf8ec9502\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7ee051a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19687\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19687,"size_decoded":20499,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"73e56b1de9d50f0450e0c75f4e1e3f51","sha1":"5a55be1b425c66c4ddbceb7ee00052ce0d6f3a68","sha256":"0c5f848c16994d0f9d9e9bfb1d5f4fd65fb0e038e0d23c05c5615e1dbe9f63bc","sha512":"b76402769919bbef918939dea02e1c5ea86755a6913b670253cc35d514fbeb96a4595707e81a7e9c004355bcf43ec61c4cec22e0557757301dc514a005f273ea","ssdeep":"384:LViOJ2cd+l5/asZAHPAbllrGbiCRtVe87b4v4qXhXKFG6c6OA+3xI2jaPXDrWLS:ZiOJ6ZAK8NRtR7EhXKQ61OAOkaLS","tlshash":"2f92c0e6a6d08850eccf4dba6ca82a8e1506c72a5bd94d374773cb7035374e216cb7e0","first_seen":"2025-10-12T07:48:56.645899Z","last_seen":"2026-07-22T10:43:47.561306Z","times_seen":67,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/1efb262854252e99.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.831Z","timestamp":1784716547831,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/1efb262854252e99.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ev%2B2tYdNZnO5K2dzdYziUwtkGBSkELjqXAOWoaZNjzqGkhqaqEdXoKtxSKpiEXkrUhhwqzySA49UowhWvFIq874M4HZHaFobB%2F6FuJqX5voRBIAKt4RxZ2EyyATY0kmyOAo%2Ft0I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"84333886e92e20ebf264d754aa89c53c\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7ee0d1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 31410\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31410,"size_decoded":32224,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], progressive, precision 8, 266x354, components 3","md5":"d48fcc099c011ae9b29934b9a8e077c8","sha1":"3829068da0867c59db1ad0edb30a86f6ab153f7a","sha256":"808f411d7747e8f6bc7d0d50d0a75907d4fe273fff7a6caf69056988aaa85905","sha512":"b9d63a5f4a85a1d47b576a073261b5265df14740d2c34fe8cd8b597928b7606d3f65404421d86b9936db3d199394193d4fefd884a6bd9be35e840d5e04399d31","ssdeep":"768:0GPtReVzR24S5/egdNffgl/AvZDEacR9LLeTAC+P+69kg:0oilRJCrdNffI/AhEacbv39n","tlshash":"28e2f1809fdbc60ce5601e3002c2a8ba9d6964d50e74d91c53ffc92506bbbc4bd67adc","first_seen":"2025-10-12T07:48:56.713126Z","last_seen":"2026-07-22T10:43:47.569733Z","times_seen":67,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/1f19ded7e906f965.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.977Z","timestamp":1784716547977,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/1f19ded7e906f965.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ybASx8MLF87xJwg1g6e8jyrBxWehHxYs%2B7XS9%2B9ncqMsDQa%2Bs%2Bmw6rxAv%2FrdYeSniihu%2BqWjIokeqD6%2BFEOxT8glc0aMz835yUjKUwQFOa0ph07dMORD9nI%2BHSEzdd7j8Gh4a0I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8de471a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6779,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/23f3035fe79e3db4.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.818Z","timestamp":1784716547818,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/23f3035fe79e3db4.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fBMx020x4ihv%2FTHrCfh6SEt91gF0FtSBC9h9wZTNcRo05oXB8%2B7IfirfuV2ss1J6djemuni4I9Jy68S2p8jBZf4%2F05yr2D2rKxwLQjPIpUAcAb%2FkYHLwjFcciRK7jIWbq6t64IM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"fce13ca6526e6e0dfe541f6e95bc4377\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7de011a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 20377\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20377,"size_decoded":21193,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"2830de20d1f744bb3a33ad4c2ea9d463","sha1":"50382faa7afcedc7929fd60537906f37ea9a9e4b","sha256":"f08d7168907d149487548a058ce0b0f0ffb5029f3c65c5d470d69e99a56b93ed","sha512":"24be110f02b1cb61bf971b69cf16dd7e8d63b2d55f07c2b97f0d04f8ea1fb38fcf826c1e7578f3bbb01918b5175e65a1c7788b670f7efef510f237ee866b07dd","ssdeep":"384:CwBgx1ZDOsG7dIujRXn58MwUqAytdX2C1uAW8HiphK3Ua9UuDd3ku5OU:C6gDZDOsMt5NwBtliPKpdUSOU","tlshash":"b192d025f7e0e271def19fbeaa41713474a27f4e9f834f852136c46d24008cd156e629","first_seen":"2025-10-12T07:48:56.651906Z","last_seen":"2026-07-22T10:43:47.555238Z","times_seen":67,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/37fee53f1cb58e14.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.950Z","timestamp":1784716547950,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/37fee53f1cb58e14.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=50TfCUpUJfspLb7wZvF2n%2Ff5lt0O4agWYX4PdgYrW20ojcXA77SaTfoiZRt%2Ba%2B6%2BJasQRfUF9JoWdq6hECp5o%2Ft5vfy0p3K4LlSJ2zoH7FDK7fumrpp6s8TbVB84iVAXj6ihRYs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ae2c1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6773,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/favicon/favicon-16x16.png","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:48.075Z","timestamp":1784716548075,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /favicon/favicon-16x16.png HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ROtSTfAnDv2Lw7p7H6gr7PcW7EkTVdFtLCpBd2IbBJ%2Ff7fBsLcHoQaSdpVoMu%2FW1lVZQrZDUwsVS03Md%2FObTZBvhU32BKvu1wx2oiL68JYQQmMEJRZM2r1fn%2FLdOzJOiTYrNbUY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"1e54984af1317cf532453fd5358da5f8\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=6,i=?0\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:48 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf97e691a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 606\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":606,"size_decoded":1422,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced","md5":"c7a4938ba7993c3407eae156b19db369","sha1":"00813a8612585b5a41d614603946b0098194bb2b","sha256":"306e668a2238e37a9d34a826ce87121d7ae13a8c363c31c3ca4620838172cb79","sha512":"6050e2f05d7fc345e5fb509301289b2e48b441201d9637f1c199cecabc48650ec055c373ec86d4b01a454614e6967e09236bf45d251e9710df53a7f03e26763d","ssdeep":"","tlshash":"91f0624f52ca61bb402a80318a3721004c7b078c10216526ef82999259b6eb07d79887","first_seen":"2026-07-22T10:31:08.01241Z","last_seen":"2026-07-22T10:36:17.060164Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/425cef23a4e6f073.png","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.838Z","timestamp":1784716547838,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/425cef23a4e6f073.png HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TtCcifVAn4Ju%2B%2FpXo%2FjvcoXWwV7QGbsisPvRQ4Jj4oyuNp8rDy1PxR5haFgyy6z19TSw20%2FWQP3Ft%2FLpbE8sAc1KpL8OQ8iM1wrkY6LplVGEdYOZ8CFwETPXC5h8lLRnE1hCFqY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"bd96338986af60087b7ffe9a23fdba33\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7fe171a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1132\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1132,"size_decoded":1948,"mime_type":"image/png","magic":"PNG image data, 48 x 47, 8-bit/color RGBA, non-interlaced","md5":"04b20105330893345b4d075d6108e127","sha1":"28369b84a763ad746bec2df4ea734deab2e8d72b","sha256":"bc3f763eb8bcea422bd126fa0c84f617f2de86d3f65eaf872d8b36c6b95dd11c","sha512":"df1d896b5e8b4576ed270f78ead380a44f0faa0c2f70cc1b5dbbbb8996d1206fa9d6f3a840dd45f8e85b07b62ef4d39ea2c88843048e5de6315c5b095687483a","ssdeep":"","tlshash":"ce21bdf306ce1b5618bb1424a1ca8c214c5c7baec6d7d15e7170f155317d440864bde7","first_seen":"2025-10-12T07:48:56.672025Z","last_seen":"2026-07-22T10:43:47.537237Z","times_seen":57,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/38882189e9d72645.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.972Z","timestamp":1784716547972,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/38882189e9d72645.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zTDQSz2XD0GGsTgMg0Kp9ViBM0KQ4RkTfSIGj6Xpo1dNif1zJ2GRISeRY6zs5dLPKxrixKfum%2FxKpwxQoXG8hqv1CRQQMQhZiC6lUTR7eyzqCF%2F9LYm5z1sNVUtXJs%2FkhElIaQA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8de431a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6769,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/c49cb31fa002e4fc.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.815Z","timestamp":1784716547815,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/c49cb31fa002e4fc.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zzsGJk4ba%2F2YUu4XSe6%2BsCPfn8U9UB3n2LqOEf0zkyvRRe41%2BNHmyVhOWmqdr9FjXqKOQjM%2BVuRdeQEk6oOShmNql28Im58OgHyRixVmNPgUcmjXeQ%2FNFJqWJJxDoikHOfMg61k%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"4365a85c9e5a9f97cbbeb8eb355bc039\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7ddfe1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18424\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18424,"size_decoded":19242,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"5394a596c9b225fd736a72ddc4d952b2","sha1":"bb1df2cbc2496db5355e2c4d47094c63c08d7d48","sha256":"455f65415ce4fbd971e18bb0f823477d7409a289b726ba7c44b2dc196fc1b4b3","sha512":"1b4e1df9174216c8adf8ec4e3a4f7860aca88d7da472f03b3806a6e7bbbc4e99aaa62190d1540d7aff4cd36ead8eb3a2c35d2ad5082268ad922c1cc42d01b115","ssdeep":"384:jYsiuKVm3x/FjNbZjGjQdVPFvwP2VQ2htoBrMJTCsqR520:jYiKVm3FFj7GWF4ihghMJT4n","tlshash":"cf82cfa0da157c56fe396d7802356c0783038454ad261ac121bffaf446252ff95ef2d9","first_seen":"2025-10-12T07:48:56.623297Z","last_seen":"2026-07-22T10:43:47.554245Z","times_seen":67,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/45bd902f4de96f84.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.817Z","timestamp":1784716547817,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/45bd902f4de96f84.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h6vrGOzk%2F2yLD3d29fLsLZUOrnkPGOIN%2FjGjsSL5VL8cyQn7Z5cu89FOBzHxmJkybXfizmfEfXHuwAWCjzCJNbt%2Bc6qXsZgse%2BEzHD0v2Tu7FaweRSwCmHnJYWOcwQq5MT3vpI8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"6929a613565eec4fa1f263833e7f9513\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7de001a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 23881\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23881,"size_decoded":24697,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"393f4894c0e31329594f3d4134390af6","sha1":"4d9d3ccc06018b47bdc16c0ddba6a139aaeaeb3a","sha256":"c6a0f17c941a19e0dc8261d685e1c01bc102b5a56347e4bfa2c1d5cc557f1f33","sha512":"58bb1d0e74a322a2bf91cd7c78b3f6192f47309d1adafdb8af01189d32e778ea8cdf7cefaa000aa69239ec01d25b1f11d9aef754cdddf6b3e738dbb49c510813","ssdeep":"384:Odf2QSlgRl7J7ti0sVSabC9AUVrl3oO3LovrnTEuEUHkJNNUA45ju9tVaN:OJTSKYZSaYbVrl4O78sUX8wN","tlshash":"36b2f2db7f8907e3686a0d324391c855d7d0ae82f63b1e0543f1e87a49750ec1a94226","first_seen":"2025-10-12T07:48:56.740436Z","last_seen":"2026-07-22T10:43:47.534299Z","times_seen":67,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/0ab954a15d132824.png","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.842Z","timestamp":1784716547842,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/0ab954a15d132824.png HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qrz8inrYRR1RJcdFMJp9kAEgF1u%2FQaIWGA2EElkY8vgfJay0CYk9hwRtA8MNxTK6Z73j01me78u2X31bojsWWT3mEMJe2wQ4vOG%2FACbBGn2TJjJxrFN0nUACF6yPLfFA4vrIsew%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"bd96338986af60087b7ffe9a23fdba33\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf80e1a1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1132\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1132,"size_decoded":1942,"mime_type":"image/png","magic":"PNG image data, 48 x 47, 8-bit/color RGBA, non-interlaced","md5":"04b20105330893345b4d075d6108e127","sha1":"28369b84a763ad746bec2df4ea734deab2e8d72b","sha256":"bc3f763eb8bcea422bd126fa0c84f617f2de86d3f65eaf872d8b36c6b95dd11c","sha512":"df1d896b5e8b4576ed270f78ead380a44f0faa0c2f70cc1b5dbbbb8996d1206fa9d6f3a840dd45f8e85b07b62ef4d39ea2c88843048e5de6315c5b095687483a","ssdeep":"","tlshash":"ce21bdf306ce1b5618bb1424a1ca8c214c5c7baec6d7d15e7170f155317d440864bde7","first_seen":"2025-10-12T07:48:56.672025Z","last_seen":"2026-07-22T10:43:47.537237Z","times_seen":57,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/955e590c31deefc4.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.956Z","timestamp":1784716547956,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/955e590c31deefc4.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LI13l29hIIwKU4Ac7gvKWj83RQKxQFCs0e%2BJ7o5gBd%2FVA4uF22ukicLHWL4KZyscwuH4mlCIhQCnJ2SXhn7kwsZZOl6lw7x8tK10FrRDFswSfQbQcvxHRwuYaif19Wxk3cSxv90%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8be321a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6767,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/822b6b3c3410f3d3.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.971Z","timestamp":1784716547971,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/822b6b3c3410f3d3.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tpX9v0J06UKzThL6ZxC1pe7ZO1B1AdyD5ago5S9iTqmhEMeAefzxGdtMKseaRmwveriOEW4oEo0Khp8rRApUwGEXuZdTDBAUuq%2FUs4dSSiUeOjVh1XejXuqbv5tD%2B%2FkxlCQbSU8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ce421a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6769,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/308996485f02b4b9.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.978Z","timestamp":1784716547978,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/308996485f02b4b9.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PsY5HexLy3TPf7gx2ObMaBW4ZypQ0bylmg0BU9SeqihX%2FdtNr6fWO52ES8wSQs4ODRygT4P%2BUhO6pmfapywJHdKU6HYOVwRetDzqDwJSLJ2IZ8tQVi9%2BTTh2obBv5ndVmhZQklI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8de491a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6769,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/7c805d6166719f19.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.980Z","timestamp":1784716547980,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/7c805d6166719f19.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oPAQKpMiGUih%2FPllMPyw8ISGiQhVIyYFqiCPfKF9JxPUlRSdpzAxpNzEfFFZ0TZjmuyuzizvxbRRaS6hj%2F5RjDyUwOmRoC3pUoRyVpNRmeRvGk5sXAyizGDIwBrRvxrq9FYYjk4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8de4a1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6767,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/101be5a1c8d24c29.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.982Z","timestamp":1784716547982,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/101be5a1c8d24c29.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UYMCp2v0A4sE5qoTy07UM2FyaZ%2BBO7ESJv0pylxShbJ%2BMa0Is8bYet7J7n9Zp7qeP3Hl96TJhMIAJeg5DvX9I9rMzEMZVHTdODhPzpOxZ0xKT%2Ftxufs3fU4pQvkWyM7xr2SVWk0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ee4c1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6769,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/50f8e3445048db49.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.804Z","timestamp":1784716547804,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/50f8e3445048db49.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zcnXNIktriezB5PMApJY8Kl1F4X%2FoBF7j3xulkEi0TmDBTFXwDBcVXrtbuixcz65Ua90NqUbdm4XMNfRsA6hk2q7rcIN665bzmoK%2FEt1l7Fu4UeJOBuA5FUN1G6Y2ZHS%2F5L%2BH6g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"407e74e0f1275b6ebe63544cc6c0f2bb\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7cdf51a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 20713\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20713,"size_decoded":21529,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"e77c18be6bc9c3458fd95679b3256f70","sha1":"96078530acc96136747f79245cf4baa1cedcf15f","sha256":"011f43ed3812a0d4bb74da712ab13f37f5ed4cabfa87017ff352f1e69bf3066d","sha512":"73749bdd6d3a83c453fde8f65b88ebbfaccb3382decb7a8f3525dac44b6a0686cdcf63e0f3feaec9adbbd27732ef2043557f4f97a6bde6e7b8e8181bedb7254a","ssdeep":"384:M/Jjb8Ms7MTWdYCioypWZSJYTso2hZP+lDmaOPACGWlDFn85YMYsX:0xHobs4SJ+DAaDmaOPVs5dYK","tlshash":"c392f1b29bd896abeb876e27e01d41f4ca999146fe31c29914b9e03e100f5f1d81417d","first_seen":"2025-10-12T07:48:56.649133Z","last_seen":"2026-07-22T10:43:47.542261Z","times_seen":67,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/834da1608e1aea03.png","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.841Z","timestamp":1784716547841,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/834da1608e1aea03.png HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YV%2FH%2FSU4UOOfbYqVGlFFZvGS05hlfX8uD8xz9vhW%2BoG6spVtlfhVH5SYHjlXzJd%2BiZevrVeV4ayP70%2BG1PYg9to20Jh7Ji8UZIrCaH3eptmLQy1mtSgncueR%2FQjvnsH%2ByDdlTlI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"7fd4547a3c9d59afaf332063de29e0d0\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7fe191a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1834\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1834,"size_decoded":2654,"mime_type":"image/png","magic":"PNG image data, 112 x 53, 8-bit/color RGBA, non-interlaced","md5":"b0e3ac9ebab6af5f48091dfaff855a54","sha1":"096de8f22039486621f167862d3cdd2f7d6d6a6a","sha256":"fed91cc5540efbbafc70f90d761c9caf1855a43f9ac0abdf58b43020bf1fca76","sha512":"6383332e70343cc4f6be1510e793ff8416c9a1d2de0b6e255121026683a162cb12075e2e41f0074d0eac618390f884a5365716cd50c2a1842b0b2dfe2c7439dc","ssdeep":"","tlshash":"8731094ebb253d6f55fd6e3d47245434a43f98bf3454293ce87745085ea520f60075a3","first_seen":"2025-10-12T07:48:56.729773Z","last_seen":"2026-07-22T10:43:47.56061Z","times_seen":65,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/4710690722a37b1e.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.963Z","timestamp":1784716547963,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/4710690722a37b1e.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BNSEwIQy02EscepZNySDBIolEzpc4bjWKf5z%2FQnPSG%2BrBLxMUSTTouL%2BYCHQ4sU%2Fz2mEZqdGv95aFOnQ8eSFR18ahst9WTuCqsMBgs2owW5J0dYZFHcFiapcvAxU2qcKT2rGFOg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ce3c1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6771,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/1f36dc3b5feb1a30.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.996Z","timestamp":1784716547996,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/1f36dc3b5feb1a30.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Gp4ELzDDnAg9sYF3TJ7gXjMs4omUdydM%2BP0sSTKw06QlnKiPWGSfJKlbnRmqG50j72koJqkY2NYRtAApgN5VoFSG07cf%2FwY%2F%2BNgPBQ366kFHCZHtiryMpwGFonDviMkY%2F8%2B6w7c%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:48 GMT\r\ncf-ray: a1f1ccf8fe551a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6775,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/themes/twentytwentyfour/style.css","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.772Z","timestamp":1784716547772,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/themes/twentytwentyfour/style.css HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wnzaGzjWl4DdlgyPnHBLFuXZhGiIXFMzxu%2FqNn%2BBRDwG5aDZcVbFTWDGKgOdLqBtMmUopNHdcqqtY9ISnhwfRKC8QHCaprwbki3ybZ%2Bl%2BqEwfli5DSPPUS%2Fp7dPnpenZY%2Fxhiv0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css; charset=utf-8\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"e157287e8fb4d01ab0f4c0ba910d7998\"\r\ncontent-encoding: br\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf79de81a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30796,"size_decoded":7885,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (29819)","md5":"ac7dc22602f36920c14958114a3712ee","sha1":"3dfa96dc5e56dbba1b294588b8019e10220ba48d","sha256":"e80ce9307a12374d24b5ad058620af6f1b6783a886936ad16cd1954e19fe1e34","sha512":"700135d6241a270aef39a9da38e10f20fab7da3e581f5f397addaa0d4ffb432f62003790adda9fc2ee09064f7c38b09851d002e6a66b5302be4875316ecf38e6","ssdeep":"384:WBHCI2qeMJ+Xz0ddOn+iIKUdSS1yFiU7gk9:WdJcudhi","tlshash":"3fd2c67b9568324cb513ce3453c85b9d4238d121e4522bfdf593aa26c7c7ba206f36ca","first_seen":"2026-07-22T10:31:08.013603Z","last_seen":"2026-07-22T10:36:17.063565Z","times_seen":2,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/a08e3675c5b2bb27.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.812Z","timestamp":1784716547812,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/a08e3675c5b2bb27.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nb08Bq5nH7VtebVSXnqsDW%2FeIhGT0h9EzYikhCYt0yVI2Evzr6zxSXXYD975%2FfGnIUbQ3H%2FeWMQBCCfevmXi0gtua8m47hBad0pJC%2FppeADAf259esdx5zSRJuS3FiYz1yX3tko%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"711a49496727efc364c969a1d1585a9f\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7ddfc1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19509\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19509,"size_decoded":20325,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"4a4a7b11403a57b9a44c6003e08bf9a4","sha1":"7213b138996ff205e92675936c5de0740bce835d","sha256":"937087e34c8fbc643c605a3aa19f4e737544ea0b2214f857c597dd3645d2d816","sha512":"62a541768c16c1f53aba733f6181962cbddf8588dbc490e8a54e74c3615190f48596df1994ca986e74ed9cef4c9add928e4c3029df9c328a5b9c3a2c88859740","ssdeep":"384:eQSkwV+SOSSnTvFygSmBAEu9Hbktb6/HqB+DMcLHTyMH9:BlwVSSSnp1ra7ktb6/1M4TyMd","tlshash":"4a92c0379b49999fe6162fbc5ea347218acf588d18bb4ba344bcf0a823501e9d41d42d","first_seen":"2025-10-12T07:48:56.736156Z","last_seen":"2026-07-22T10:43:47.55895Z","times_seen":67,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/bbedbf8d50d2470f.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.951Z","timestamp":1784716547951,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/bbedbf8d50d2470f.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=51b2Q3EuUZ2gpssJ5076SW%2FV1dFZxfHNClZoIx9QUl7Y%2BG3hqsfzL0xhLWi19%2B3%2FU%2BVLyO9FBeFcBrM12qP9nvNvVQfMVCmy%2F4V1JcVGS1Ee1INgvmVlN011kc%2BWFg0XMgxA7tA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ae2d1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6777,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/3bca7356a5bd532a.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.988Z","timestamp":1784716547988,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/3bca7356a5bd532a.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EZzKy8CfPRPm1f7a%2BNbYZ0Am3UUvpTKgQGV4pYPFAysXyfL3q%2F5vtxpmyx6WTEaef%2BHZbarIr4Z2fGLCq1jAmh0hAerhNWAr8BZJocpqb24GbfWly0uJyFXv%2Bq5nydQgQZS%2FLWU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ee501a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6773,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/32e7861a3c0c01a9.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.994Z","timestamp":1784716547994,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/32e7861a3c0c01a9.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VRD9sFjHhwRz6mKHxyGRN73HbPaCum8TXJ1BbrFWH8dibZoBYhMIaAzTIlOhLLINg3zUflroxDBLg2AxHeMDOYn%2BDwv%2BX%2BFhacOvU5R1neBvsQAX%2FnaqQvlwCMoFB1phrqYn3mE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:48 GMT\r\ncf-ray: a1f1ccf8fe541a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6771,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-22T10:35:47.474Z","timestamp":1784716547474,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GT9mJEmKf6QjLbsvD8ToWaskKZ7bK0jGYh4CNn%2BTLP1hbVlMn9GKNvqBtwSfB7syDGeuJsy2JRV8i6PULIGuyW1IbDJmy7FZleu6xwhDHWJiARWIhiYYjQiERjns0N5GNx5VwUw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/html; charset=utf-8\r\ncf-cache-status: DYNAMIC\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nvary: accept-encoding\r\npriority: u=0,i\r\nserver: cloudflare\r\ncontent-encoding: br\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf5ddb81a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Twenty Twenty-Four","description":"Twenty Twenty-Four is the default WordPress theme for 2024.","website":"https://wordpress.org/themes/twentytwentyfour","common_platform_enumeration":"","icon":"WordPress.svg","categories":["WordPress themes"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":53491,"size_decoded":10136,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1405)","md5":"90085a187c2ddb9fb9fbfbbe52681afc","sha1":"100d6534118822fa74b0b4fb722e0c3ca8418413","sha256":"f9212162282a7e554af36e66be22f1a67c187456874d238ec54bc1c9b641e1d1","sha512":"d292ebbaf0a086ab0d6bc4a998b0aaf69a1f25663e6925abca47ec4be67f81c8e14704e3b9db749a73ffb2e379b134928d25271e4636ca69a17e4923f94cc7d4","ssdeep":"384:Xx3OOiOMM8aSRgt/zLfMjFQk2ybtNCWpi:FOOiOMHvutmo","tlshash":"52339732a0f9502313e395d1d92a2f0ffe81801fd51a9a85739c8b9eafc5e418d6369d","first_seen":"2026-07-22T10:36:17.065242Z","last_seen":"2026-07-22T10:36:17.065242Z","times_seen":1,"resource_available":true,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":6,"connect":18,"send":0,"wait":50,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/f082237458695b7c.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.807Z","timestamp":1784716547807,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/f082237458695b7c.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=t6S1zx6tejBCgIqnR96YWjJSNjuf%2Fsjh1fuFEfMe%2F%2Fit9zp27gYd1%2FE3mQOmb10oWlnA2rUkEshBML7TVfeaWTehiIQgUjtKah4Wj7MeOOcXncP4VtYvvOmaWzEJFeAcsakjpwo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"4251277eebce4731e2b64d9ced9cf1cc\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7cdf81a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 16558\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16558,"size_decoded":17374,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"c1f6ce0e2b2e2e329d64d66d718933fb","sha1":"63c35c8ca4376f7b980b32b140a580752584ea5b","sha256":"d6f8f02c9efa915b3e3bfbba492ae7f9cdfcc34da0638c569fa77f6d59894992","sha512":"738db278d8e84dcbdfe08b87b01dcaa110356c28350a225a59122ed79507c045a0870e047ca838969d30b1233b4cccd4bc910eca73d530b75c788096f4a89018","ssdeep":"384:C5ccj51Kq83NJFZD/oF35jhvThvZQhccExW0bseT9Da8bj4j2l/qQe4:mccT83NJFZk3jl1vZ0VSvtxHl7","tlshash":"1072d1ebbfa5a015d5117c96ef472bc89b00f41f4c7483e538b4d886a867681bc1a4f3","first_seen":"2025-10-12T07:48:56.681199Z","last_seen":"2026-07-22T10:43:47.566725Z","times_seen":67,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/b9c9e91de1bb8b31.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.822Z","timestamp":1784716547822,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/b9c9e91de1bb8b31.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=epzO0GuetuUGsTCNLqMZjbZkVGaOf2BeoI%2F%2Fhnl1DsvdMzKPjI4dhhIbD%2FYRNw4pRnS37EgAnW6TERAHJ%2Bjy%2FR5dzflEJ4misTJUmAW7DLnJ6GjIjuWS9z4NoLN8pnP%2BEdGvBf0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"21f8a3aa40e43fe563885b84995d54b9\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7de041a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19565\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19565,"size_decoded":20385,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"79ab9a51578a15bae5fcc273367f4df3","sha1":"65d62304507516c239a0f6e77e3c68ac53d79a44","sha256":"b5f51e3882841d3ebdf9a83a0e5ee1590ac4b7a6ee08bc240f1bea03a68d6d10","sha512":"aca431c380aed4fa232cb0eb799ad059d5ae4c240aa4bcc7f17e89faf4e6d13a68a26d90fcd46e9a21ba0def297de3db418ea1eb571d5d635d4848acb4d54017","ssdeep":"384:Jgp/BCqYuEjIxy4bkToQQ7+0xsAK1YyZ/uFCeHKHQaKvDD0zNS8VHfZWJOXhN2N1:KpEq9o/Tof7nnEYyte9HKHQaKvDQzNSj","tlshash":"9792d1e7e1279688b90b4d2b54210f3424f4ec872bcd1598bd3fdda6e1796d85a0e08c","first_seen":"2025-10-12T07:48:56.661326Z","last_seen":"2026-07-22T10:43:47.54308Z","times_seen":67,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/5875728cdf8fb740.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.964Z","timestamp":1784716547964,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/5875728cdf8fb740.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6aldZ4Cr%2BBrCnTWYvAdYmVvrN%2BbsZzfg405LUviIr2x7hSl%2BFKnHQtfXMXsM0P0mbUU83sYcR2cpNyxjs8svM7%2FmIPKYu2MHZHbqjOzsSs0xTaFAE%2BarlKgKRP2HLqTQCKSlE0Y%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ce3d1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6773,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/cbc157bc27bd8a6d.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.966Z","timestamp":1784716547966,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/cbc157bc27bd8a6d.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Xcu5HGozz%2FWcypP6Po7nLDGAqHIVEsuaMbdXiQSSLuHHNzDIHpaeuLme051ur2rG%2BR6l6%2FOdHsY6Dtx%2F%2B5zYjyz%2FgbIANERBZCE2Z%2F6jUFrTpdX%2B6XQmtUPTPuzDKobpbf%2BW9sk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ce3e1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6781,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/382c756bba70337e.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.969Z","timestamp":1784716547969,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/382c756bba70337e.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=i4uZhMrFdk%2FdioGqfu1c3GEOmnx0BmresIgjUwBeWaIMGJ0n3HiDSwcac%2FIoy90Gf9VBbs9MPJf%2FDWAlwfzcLUBVBcveQF5La9p34b2LGMZTJcpbCENVS3G4Jejj7fLO2tJYXhY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ce411a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6769,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/d045d4f57bc25703.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.975Z","timestamp":1784716547975,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/d045d4f57bc25703.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pPA1WDt%2BZfwbSMp%2BJZD7zbB1oEj0dPpZbogGtxKrDgcYfYg1GpGsAKMxFcTOsL%2FUkArrhHG8Plkpc3qiDZRvW%2Fn1cSLuVeSyYg7LLMK8YCKbauIP4b%2FTwkc70DHGAy%2BacwAZHwM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8de461a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6775,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/ff89ffb1affba500.png","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.839Z","timestamp":1784716547839,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/ff89ffb1affba500.png HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UePyiQzQvBimRKqJ36ePswRfHRXiHYXtuOEoc25mevu6EnBueOXHaCK2Nfiow8Lv7yAPdnVmVC6SosB6s2yUVYsetFwkqurwXo0KDL2TwSY9dl0J12feTzBEN3Ba7uUD8Gi3ZKw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"b743a4fc3f79d3d9726e8c97796da638\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7fe181a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2070\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2070,"size_decoded":2876,"mime_type":"image/png","magic":"PNG image data, 200 x 29, 8-bit/color RGBA, non-interlaced","md5":"d2ec76eb63497a3be6c84d76342f7c8e","sha1":"22dec907b7dabe554c2cfb824a3fbfb06412e33c","sha256":"8a0a1981ce492013306885e7243bf162d403736313dc55e2df283cd00007be76","sha512":"a69a9a1ca455f541cf6a1085866341c0979a28b4d26cd5c7c5591ad9845ee2c03adcc83aec086a48a7e39d35bdfb86b0ab98fe7856dae9698dd09a0a85597f8f","ssdeep":"","tlshash":"ce41f8da2a10acf53c69c6399d54baf19512562fd58fdceeff1531380b09106cd74822","first_seen":"2025-10-12T07:48:56.63266Z","last_seen":"2026-07-22T10:43:47.559779Z","times_seen":65,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/81c730bdc0d3780f.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.948Z","timestamp":1784716547948,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/81c730bdc0d3780f.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nagjrAI7iaNIICowAqWr6wvtScYMJIFPZeJWAmtp9zUrfzWU98QqrrWzPVkdPzk3l%2FElGm5HL1k18qK59UnHNLDrUwXZjp7z6sZp17ut%2FHVHYIiB3rVB9An6DqRud5F6ToYRx18%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ae2b1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6767,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/96cdfafcc4a06cdc.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.953Z","timestamp":1784716547953,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/96cdfafcc4a06cdc.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qoWQN9GyEVGS%2BlM9%2FtaTkSkSbp7QlKw6k3XONT6vI8ZgqOiDgeedVU8r0U4h%2F3zfznCFs3VhGtJcvOho9WGJIaZAl2nEO6SMOKg2xAx9JWhZvFy8S%2FQvtezh9nwJJmzEMUIR7vQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ae2f1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6771,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/0da8c170814f63f6.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.960Z","timestamp":1784716547960,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/0da8c170814f63f6.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6NTBLy%2BUkIBfHskF9YP%2BDfEXUofO90vf3IeALl5NUs5IUdH75nf2QxcfQ80daOTJ4AhN4wjZWX1jNbKZIeWZQxehNCYBnp5FBANtBsl1jSxdWAPwH5BTWfpbrYvO4BH0eR0u0Sk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8be371a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6767,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/50e29faa9b1522c0.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.798Z","timestamp":1784716547798,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/50e29faa9b1522c0.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iQ6cm%2BKx5N6iHwDUFv61RBQe2NfZwhWBiD23gFANxYH5%2FxcFpXBwBU7foNL%2BN5W%2FgXSdo6mJd5nk8a4blBNafNm57zYjyzo4caE7In8aXlu5KENnmD4DhpjJRejyJQYf2xoAT7Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"5803ce9dd8b5d351d4dc34e3b981a88d\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7bdf01a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18867\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18867,"size_decoded":19683,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"a1f257fd5852a3367435d988e537da48","sha1":"f418358044d2c53cbbb99848d3db32b1eb8f62cc","sha256":"a5cbd71502bb8465b631e6316ed8ed331efc325855b98b0cefd0896e3e2e237b","sha512":"b662716c76116fbf73b06879a650a325c7ad5ae167925c6bb40e10c1c8680e7a87bde646a69cc382b5e5d5212b822cdff2738b94e5aebbe8b597730ce0135c68","ssdeep":"384:NqtOxX6jU2O/2ODee0/QIo1Wcn8BpDfV5rHRg84ZA1l3:UOxX63ODeQMc8BpDfrHN4ab3","tlshash":"1682d021939c5855f52e1d3cd28373d8a1c63a8f4e477be8a1b2f2b2792d1cd94ac901","first_seen":"2025-10-12T07:48:56.613703Z","last_seen":"2026-07-22T10:43:47.558044Z","times_seen":67,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/05467886cf10f382.jpg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.810Z","timestamp":1784716547810,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/05467886cf10f382.jpg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vHFc5wBWyU49VXtzQjHfU6NR2TcW7ZywJpyDpnY67C71H6Zk7XnEWforWkXvvjtIZOYEG9vCo2%2FzQjq8au0n%2FaPBm51B509pWaSVn%2BVaC3ep97AcJesZfjwFDg%2BJDzBz4N%2FR6I0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/jpeg\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"efef86a971c8b751701be779d62c73eb\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7cdfa1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17980\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17980,"size_decoded":18798,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"b97d085f5ff96cbe9974c0f0107a897d","sha1":"4e39de0c132dd5c10dde388be9eee4e7c29c63f5","sha256":"12c48c5369f818d2e15dd3ceed42c5424d3ab2ae6b71b22aaf3f8c596a54f4be","sha512":"95870b0cb22240ad1c6606ab33075c9123f7a45d803baee582ac2221150b3f6c0e3d905b7ac65d9ae84dfa9c02a4df8eaa385f40c9d0c5da4e0abc10b6bf9c0a","ssdeep":"384:UDOPgdLkWD5vxQCOi8szsbtzYThKC7zOxEEM0GhgBpFUoP:UDXllPH5UfQycoP","tlshash":"9d82c04336e377487e6c4e754abf0735a10ad23760623e43427ce99a2d854ec7d827ae","first_seen":"2025-10-12T07:48:56.64297Z","last_seen":"2026-07-22T10:43:47.570631Z","times_seen":67,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/2724ecb04e05a872.webp","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.832Z","timestamp":1784716547832,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/2724ecb04e05a872.webp HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1kP9C3w0RootFixm7ofvjhlXoqDmrVENOZXTQ2VfMDqiX6vsvUVoahyO0QDsVO5R6PvRXIQzxvLBNLmWxvFtcYsirZKq3REmkHAeV%2BycrcqCJL63UYIVg6YMmruTGIqlfIQDvt0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"78e4d82b238d72f71a3c1eda2de7d40b\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: REVALIDATED\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1f1ccf7fe0e1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 42616\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42616,"size_decoded":43426,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 400x866, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"323b5f866c85249292a6fb8c99cd9c86","sha1":"2c25a75b4c94067a33ab3e38324cab0a97fa5b67","sha256":"b61ec35c56b4fc213190a74b72366975b5a3be0223c03f539b4025cfec8c55d8","sha512":"bae23ecd07db1d0f7eaecd4d18dfb97fcc8e7cec147dc8d3d1802ebe15e40d72f00d737f1ef8f35e25169bf5ab9366e0ce5b1c90ad841b5d4ff5eee4eae16b6c","ssdeep":"768:epmUOf1iCDJOVoeyREgtsMfKwuwiDhoXuyj1cuf9Z+3IrFzutmTOk:bCzoZolhyW89Z+s","tlshash":"d413e121a85f88e70409c4ee8ebd8f5fbe197d9173c9f691020d5055f2ee991f488fa1","first_seen":"2026-07-04T10:30:55.312615Z","last_seen":"2026-07-22T10:43:47.544172Z","times_seen":27,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/3b0976807d41bc26.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.955Z","timestamp":1784716547955,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/3b0976807d41bc26.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MupVZ90hy7j51S4loi61cfrPtJNvD9yfDcO%2FGfb9ooHD3P5hsH2LBFjWn%2FZa3%2FuR2lU3zOdj05HlZmTKLgiEbyurkqOQyq8bPqsxhbONR0AcrTe%2FnSBXQePR6brrywV0URa1S9Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8be311a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6771,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetromania.com/wp-content/uploads/2026/03/d17f9e729e23a7e3.svg","fqdn":"rainbetromania.com","domain":"rainbetromania.com","tld":"com"},"ip":{"addr":"172.67.189.8","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetromania.com/","date":"2026-07-22T10:35:47.987Z","timestamp":1784716547987,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetromania.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 20:00:34 GMT","end":"Wed, 23 Sep 2026 20:00:33 GMT"},"fingerprint":{"sha1":"16:8D:DA:BD:16:2A:EC:9A:5C:8A:A1:4D:D9:A0:6C:E9:C0:61:3F:85","sha256":"CA:D8:97:50:86:EC:A3:5B:87:FB:7B:68:C1:12:B8:C5:7D:43:DD:DF:D0:53:6C:B4:D5:61:09:FA:CC:AB:CF:DB"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/d17f9e729e23a7e3.svg HTTP/1.1\r\nHost: rainbetromania.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetromania.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kSA0NHw2Zga%2FBGoW4dxZsrO9TytApAyteqYF%2Bh7qwpYomvHgDJ2UeRV95xyZCWbzH%2Bs8TH7R6CMre6UqfANs4A7pxRA97xHsXJNQUrT8YGDPGnsXDXadVyWBETY8ZDtmf%2B%2BoCGY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/svg+xml\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Wed, 22 Jul 2026 10:35:47 GMT\r\ncf-ray: a1f1ccf8ee4f1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6773,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-22T10:43:47.533385Z","times_seen":65,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetromania.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}