{"report_id":"6f25bf74-3f69-4df8-9c08-f0f874151074","version":0,"status":"done","tags":[],"date":"2026-09-27T02:38:45Z","url":{"schema":"http","addr":"norainbet.com/","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"norainbet.com/","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"title":"RainBet Casino Norge: Spill, Bonus Og Regler","dom":{"size":87387,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4181)","md5":"2fc24eb6b1cb7c2070c38217b15e80cd","sha1":"ec1ba447c4442f8917a01f97fcd342ed3db3ba28","sha256":"771604881abe0994a7611d9f60020cf2a480f914601626bc99169a08f92bd69d","sha512":"fcfde6337fd64ca5ab85a60b5a8acd35d4dc2fbbf7e3130f6f3c4064646494f8b8f266e269296cb003ea4624bc5a4f56633e259c41a9074104aeb9b569d16f57","ssdeep":"1536:jRCqKvPhfwxaL0wKMEgL8fd+nWBfZHTBLoxqfVELB9p:jRCqKvPhfwxJIp","tlshash":"2683732da1f43f3e252702abe9593b1e12387e87dd1d18a57aed44e04f82d6cb837644","dom_hash":"domhash5e6fc73fdd8d0cfb2f8243e8c8e1eb43","first_seen":"2026-09-27T02:38:55.494146Z","last_seen":"2026-09-27T02:39:59.934756Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"norainbet.com/","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-01T02:38:45Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"norainbet.com","ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":48,"request_count":24,"received_data":1046422,"sent_data":13335,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"siteshub.io","ip":{"addr":"104.21.94.140","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-06-30","domain_rank":0,"first_seen":"2026-09-27T02:38:51.255004Z","last_seen":"2026-09-27T02:38:51.255004Z","alert_count":0,"request_count":1,"received_data":780,"sent_data":558,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"norainbet.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-10-15T06:36:48.481088Z","times_seen":455211,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site-s2d10cd98.796a8ea99ee8.js","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1ac0243fde7b64454492d6405172d42a","sha1":"0b12a1e6ba1e0ae8da84324ab82683634af5f06f","sha256":"fde541962fd7ef73937bb532b16a7f8b5f7e0bfb76bab92615e699bc7270363a","sha512":"18538e6995f3ef047d0dd72a91af047432fcd60bb23d370b67ab6d95d502a8ca10aa1430efbdcdcd81e61a0583fc8ae42131b0e1c30acbb2e5fb92eb2752713b","ssdeep":"768:j5uQuls754Vj7I7YPf/6WCs502F8dxJK8FLDKqqBmP5w4DvLyLhMsA03LQ1+N7aj:j5u1/IshCs+2FqxY8FLDKqqB74DvLyXk","tlshash":"b713d6ada4e216b647bb21fe9b9f578572316167d00ac8103d8c99c41fc0a1613fafed","size":44427,"data":"","first_seen":"2026-09-27T02:38:55.56111Z","last_seen":"2026-09-27T02:39:59.952048Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"norainbet.com/api/track","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:25.168Z","timestamp":1790476705168,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"POST /api/track HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: application/json\r\nReferer: https://norainbet.com/\r\nContent-Length: 491\r\nOrigin: https://norainbet.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":491,"data":"{\"eventId\":\"df43208b-4853-4d33-a638-103f996685ad\",\"type\":\"engagement\",\"siteId\":\"norainbet-com\",\"visitorId\":\"anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e\",\"sessionId\":\"anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e\",\"consentState\":\"cookieless-essential\",\"cookieless\":true,\"country\":\"US\",\"language\":\"en-US\",\"timezone\":\"UTC\",\"browserAutomation\":false,\"path\":\"/\",\"url\":\"https://norainbet.com/\",\"referrer\":\"\",\"title\":\"RainBet Casino Norge: Spill, Bonus Og Regler\",\"device\":\"desktop\",\"engagementMs\":10000}"}},"response":{"raw":"HTTP/3 200 \r\naccess-control-allow-methods: POST, OPTIONS\r\nx-robots-tag: noindex, nofollow\r\ndate: Sun, 27 Sep 2026 02:38:25 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\ncf-cache-status: DYNAMIC\r\naccess-control-allow-origin: *\r\ncache-control: no-store\r\nserver: cloudflare\r\nset-cookie: sh_visitor_id=anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e; Path=/; Max-Age=31536000; SameSite=Lax; HttpOnly; Secure\nsh_session_id=anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e; Path=/; Max-Age=1800; SameSite=Lax; HttpOnly; Secure\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NqP6UUzxNVe9YO1V5dtD87dY2UOobaGbVCP2IZXAIq7JxwUsRIglDpqb9%2FOeFqhuKZ4PLnchAp4pvKEZBEJOuXg6MGOQx%2B0rZk5HqxpJQaHBIQlJb6XyEutEjZk16F9RmUafTr0U3Te1Rg%3D%3D\"}]}\r\naccess-control-allow-headers: content-type\r\ncontent-encoding: br\r\ncf-ray: a41721cf5d2bb517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"sh_visitor_id","value":"anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e","quoted":false,"path":"/","max_age":31536000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"sh_visitor_id=anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e; Path=/; Max-Age=31536000; SameSite=Lax; HttpOnly; Secure"},{"name":"sh_session_id","value":"anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e","quoted":false,"path":"/","max_age":1800,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"sh_session_id=anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e; Path=/; Max-Age=1800; SameSite=Lax; HttpOnly; Secure"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":94,"size_decoded":1189,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"6cd2d24f1027cb25a587c753a917d5c7","sha1":"f863bfcc8bdb79717c3faf18868a1b65bf6d63a1","sha256":"b4d2b0423224bd31fe6563ec4d3f2e1b375123293605be558b02b42df4b6ee77","sha512":"5ad9533be6e8e916900f05a8d149fb859442d3eaae5008bb2ecf9d315bec58a5268646b59f4c72a5f64371aecd516c2e63bb286cd7aadca232d4b219a1d09b34","ssdeep":"","tlshash":"5ab012580458807184ed000e12843e050b7d9066d5807498fcbf6d0411238890370447","first_seen":"2026-09-27T02:38:55.49688Z","last_seen":"2026-09-27T02:38:55.49688Z","times_seen":1,"resource_available":true,"data":null}},"time_used":178,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site-s2d10cd98.92cc1832d9cc.css","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:14.981Z","timestamp":1790476694981,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site-s2d10cd98.92cc1832d9cc.css HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lDpHcOedlzkpOD9fNFmrOaV4dMYDqjZrpfN1M0hnjNZ9lqrFYPMg0ZNYpQA4L1q9v8x3fbXJTVRrdE8zUd%2F2E5759nZVBaoR15AcnnjCGXMyQaO2JbRqUTiSoPB76OCq\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css; charset=utf-8\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\nx-frame-options: SAMEORIGIN\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\netag: W/\"8820a468b5322afd0830133871b043fe\"\r\ncontent-encoding: br\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 93322\r\ncf-ray: a417218faa87b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":115529,"size_decoded":19645,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (31141)","md5":"f34408a4cf63f2bce89a9e26a7523faa","sha1":"0917c14904454f5a73b8b80320d9274a87368e45","sha256":"8c0e0067c99044bdcc053551f618f6a2563844e3a7daa47b7e43731828554bd5","sha512":"0866b7d6b5bcf107a754538907e133b6bb90523af1cab55f7f536645ca89bb462f199ea421e2ff83646c9a149cfc6a831ced36c4705bcc1d4fdafe5ae71e97ea","ssdeep":"3072:m7lQl7lj9hVyOucU5D+YCb7w6E3GxMEKp5a20XNwqIjode44Z57p6uA+tO+I6HXO:m7ml7lj9hVydcU5D+YCb7w6E3GxMEKpK","tlshash":"dab30d3a51c52b2c713686779d9eaf8db3349032ef4f09d8ebc5a1e88bcb4921573605","first_seen":"2026-09-27T02:38:55.498525Z","last_seen":"2026-09-27T02:39:59.945071Z","times_seen":2,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/logo-1790280273439-rainbet-official-header-f496e5b25923.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:14.994Z","timestamp":1790476694994,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/logo-1790280273439-rainbet-official-header-f496e5b25923.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ngfF3uK1wwAaecGRyrUlqHKV0KAcpTMlSmB%2BwI2uzNCr%2BLgJjTiFJdoaNJtQx%2BPb4h9laOBbirYPElAKhqctF%2B7ivH0confHqzOc7AnEF%2F%2F2U%2Bo2wpJP68zGzFjBLAUh\"}]}\r\ncontent-type: image/webp\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"e283063bc8bae9342d5c5eb71ed1b0dd\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 70901\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\ncf-ray: a417218fba8ab517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11632\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11632,"size_decoded":12536,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d502e87a0436750d01cea383fe4ebe42","sha1":"3f453cad4b67111a5b963d5ac561ec9a1111590d","sha256":"afa8a53b1a1cf13774615f88c048f248d4f99cc093f92cf584434439f6b03b7f","sha512":"bdff82d87d5151fd844d09f079358ad429afed7a1c3052d439d8f85e0394674c20f0cfbb283835975a30e9111f6306e3a99a903157f910659f3ab100e78239ca","ssdeep":"192:4U1hAa8w2ZAzKTZQAMVEWxTXj6xFpyjx1igWb/5bgF15JgAMQBbopNLnl:HhAa8w2yKTWBz6Dpyt1PWbRbgF15Jzb6","tlshash":"ab32aec95bb3d4300fffe1b611e53e9c46d10cd31e6614558b6ac8025adbc9f031aea9","first_seen":"2026-09-27T02:38:55.500326Z","last_seen":"2026-09-27T02:39:59.956919Z","times_seen":2,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/cover-1785949124231-8a1dd4b60d9d.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.114Z","timestamp":1790476695114,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/cover-1785949124231-8a1dd4b60d9d.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FdI%2FS6sM72HW%2BtUg%2FOxHytYWGMToaCEkoCvjlVXJ7QEzJMZijtPIkKlh3VPnEHu8wM9ETJWehR7d1gVbz3WzZaqrsZrV9Ph15woXerVA0VR8J9BAyLPL8sooOnwG7a4D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"6b82ac9fdddb1a160301723e219e7f54\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 93322\r\naccept-ranges: bytes\r\ncf-ray: a41721907a8fb517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 44238\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44238,"size_decoded":45134,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9004c2db4c6e26b2e5370da4d8503546","sha1":"0728f74722eb52b9c825464ee2466f211865c6e7","sha256":"de6d14b4f8a1444082b3361613b468e8e712383f1020cf75dfb8612fb11dee90","sha512":"5ad4329fa7b4321f22106275f3e21202ec48b546bc06d63777e92c0ad473dd8d9370c599fc3f77bb5feec309f15d0ff033c65d05fdecec186360cb531255e104","ssdeep":"768:iUVx/ZqWFTCJre2nZ8oHdK42WEu0pprP1Jhmt3K3cV8AiuG/a7oNp34:jx/4CEpOCd/2W9MhPzhW3aShk/jNW","tlshash":"7313f27b67dce6568770482fb95a690d7802d67bbaecac5153c07d73b60804c0b3cad1","first_seen":"2026-09-27T02:38:55.50183Z","last_seen":"2026-09-27T02:39:59.952938Z","times_seen":2,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/hero-10443b3104e5.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.128Z","timestamp":1790476695128,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/hero-10443b3104e5.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nPVaCV0gZn46GTvgKgiOX9LMfBtaHshTDmTGZ78V5gf9pTVBABouv5FyFu2KFqYB%2B4AXkHUyse7j081ciG6tAN8wpsRtA1GkvQzTFkV0sc%2F4qSELWeUo4%2FY%2FRPSlXaBF\"}]}\r\ncontent-type: image/webp\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"7ef32a3364411e78d5b035696d37a85d\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 70901\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\ncf-ray: a41721908a96b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 42110\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42110,"size_decoded":43008,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 640x420, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"23cf55fc325534c704fecce0218a666f","sha1":"9f4a351993ee67c59ae8c6137643dd14ecda2514","sha256":"a58e8c484df73f38017352e6e5a65ac40a7234b63bb309f58b27047517c56e4d","sha512":"6b96db6d7d65917063b38afee18d34c65622190fa540c7b039a4a78277fae57f449680c06dbeb51f72dcb977693d883baa157641dd3e1f749b1309c3d4c18765","ssdeep":"768:Lsvrt/mafi6wH3DeUPDvZPU0bJX55lSclMb8HiPcMycrB6utCoi3D4xEk:PT6EDec9T9kcU8HiPcMfrXcogD4xN","tlshash":"a413e18fe9dcfe15c16c8a8b0a602aeb7e6a21fa8453543255eb59f683d4c21e31135c","first_seen":"2026-08-04T01:51:58.194002Z","last_seen":"2026-09-27T02:39:59.955113Z","times_seen":7,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/hero-ee8f6befea8e.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.132Z","timestamp":1790476695132,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/hero-ee8f6befea8e.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FDpykM2CSK6X7ChRSinlIMGwHlSvuLFike0agjDCsKPehvdrB%2BN4DstrtKSCZvC6QzqUwb%2B1qrZkBJixGz%2FUbO2JbmYQFmBup1JPHkw6cAxCJ02CiBSNPEFPEv2CIkSg\"}]}\r\ncontent-type: image/webp\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"663f5c118b62b61bca554b4edb73ed9c\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=4,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 70901\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\ncf-ray: a41721909a99b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 45698\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45698,"size_decoded":46594,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0f18ffef1c3890536f2e4c8e5a0c20f9","sha1":"9785a6f884851a647aad81b9f2002dc25d8ce8a9","sha256":"70118f01f078dc5270946c04f8d3cc259cd7ad670303eb2693bdb00806cb4a25","sha512":"1df2cc8424b11a1a4383c8bffbcf1d63482d9cf98b4dd0e62d5bac02f6f867688638249b3fca3a66aff3915ffcc44fa30f41b8a2194fb01ca722b869b48cd5cb","ssdeep":"768:HBT6Nh4Fox5SmmRXsJqSH4DSml/glvx4lR8Tf7A+i3RnNB2+Vk8/r5ZNvtyy:HB64ax0ppQq/DSmloJxPfsZ6lEZJt","tlshash":"a823f1b86eac411d977ddcfa634afa3861d02163d0060f7bace7914ebca9740f5d8818","first_seen":"2026-08-04T01:51:58.182399Z","last_seen":"2026-09-27T02:39:59.956227Z","times_seen":7,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/rainbet-screen-0d383b7de3642dbb.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.135Z","timestamp":1790476695135,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/rainbet-screen-0d383b7de3642dbb.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SqcjF927jUKs7IDsvAmDlUG0XqlaBB11go44Ky5NZcEYbDSYxTK0E1rBgkyaCQIZG7iHXZct7XPAG5YqBBvedLhXuUV0cm3vWrcT3BtxBeDD3EduzAotIRx5fJ849g5p\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"e6b2c29f7478c5dbdfe596d5e53dbb2e\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\npriority: u=4,i\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 93322\r\naccept-ranges: bytes\r\ncf-ray: a41721909a9bb517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 37702\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":37702,"size_decoded":38592,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 800x530, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3b92b01266149386b053101c4308ec91","sha1":"f80a099289c18a4a757a2a2f8e42ccc2a83fca55","sha256":"60ede3495c7735c7c40b141a663da184fddb84614458d43ddd2cd0a6260851f4","sha512":"4de40e1ad5a070517e097a44a0f4a1b22cf9548dc5c47c160958d59415f53be5f470e21a7ace79439aa66da73a749054b880d9e0ea36f3f980d4e30949a06e71","ssdeep":"768:3IVywwAur+IuWCcLJbsqgq/j0sylVWN0D/2ch/YKf:3+y7+0CclRpLeSqiy/Nf","tlshash":"a80302bb0d59685cee44e534b842bb9c77fcc4361221ac917acde6646a803d96bc25c8","first_seen":"2026-09-27T02:38:55.508265Z","last_seen":"2026-09-27T02:39:59.937141Z","times_seen":2,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/api/compliance/consent","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.485Z","timestamp":1790476695485,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"POST /api/compliance/consent HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: application/json\r\nReferer: https://norainbet.com/\r\nContent-Length: 246\r\nOrigin: https://norainbet.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: siteshub_consent_norainbet-com=%7B%22consent_version%22%3A%221.0%22%2C%22policy_version%22%3A%221.0%22%2C%22timestamp%22%3A%222026-09-27T02%3A38%3A15.159Z%22%2C%22preferences%22%3A%7B%22necessary%22%3Atrue%2C%22analytics%22%3Afalse%2C%22marketing%22%3Afalse%2C%22preferences%22%3Atrue%2C%22functional%22%3Afalse%7D%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":246,"data":"{\"siteId\":\"norainbet-com\",\"consent\":{\"consent_version\":\"1.0\",\"policy_version\":\"1.0\",\"timestamp\":\"2026-09-27T02:38:15.159Z\",\"country\":\"US\",\"preferences\":{\"necessary\":true,\"analytics\":false,\"marketing\":false,\"preferences\":true,\"functional\":false}}}"}},"response":{"raw":"HTTP/3 405 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IaF%2By2mMqetWzjTWyRhayDtHsm4yM7up9Sv8lsgX5DEDHqqqAikrPuaHC1UnMOjsDKTK9Wfk3WfCc99qxi62UEQ%2BaiI3wLzvClqUQ6dDwk8oxPF1pfi9wT01GuYpWFan\"}]}\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a4172192caadb517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"405","status_text":"Method Not Allowed","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":1769,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-15T06:37:44.498989Z","times_seen":19115586,"resource_available":true,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/api/track","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.487Z","timestamp":1790476695487,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"POST /api/track HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: application/json\r\nReferer: https://norainbet.com/\r\nContent-Length: 468\r\nOrigin: https://norainbet.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":468,"data":"{\"eventId\":\"f5e5ff09-8c24-42d5-84e5-62a06eb9270a\",\"type\":\"pageview\",\"siteId\":\"norainbet-com\",\"visitorId\":\"anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e\",\"sessionId\":\"anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e\",\"consentState\":\"cookieless-essential\",\"cookieless\":true,\"country\":\"US\",\"language\":\"en-US\",\"timezone\":\"UTC\",\"browserAutomation\":false,\"path\":\"/\",\"url\":\"https://norainbet.com/\",\"referrer\":\"\",\"title\":\"RainBet Casino Norge: Spill, Bonus Og Regler\",\"device\":\"desktop\"}"}},"response":{"raw":"HTTP/3 200 \r\naccess-control-allow-methods: POST, OPTIONS\r\nx-robots-tag: noindex, nofollow\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\ncf-cache-status: DYNAMIC\r\naccess-control-allow-origin: *\r\ncache-control: no-store\r\nserver: cloudflare\r\nset-cookie: sh_visitor_id=anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e; Path=/; Max-Age=31536000; SameSite=Lax; HttpOnly; Secure\nsh_session_id=anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e; Path=/; Max-Age=1800; SameSite=Lax; HttpOnly; Secure\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VDyXYsZhh7SGyG%2BuvRNsxqku4ccFaYGqguLs9YU2VEaT32U0J%2F16k5OAlZ2kRq5hzPhbVDgRpltu7EvCaPjs4I3XUhr0xLDIlsKha2gcdqpDTllBCPJwC5N8ofUq3Ilf1JTVyguoR1CZ4g%3D%3D\"}]}\r\naccess-control-allow-headers: content-type\r\ncontent-encoding: br\r\ncf-ray: a4172192caaeb517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"sh_visitor_id","value":"anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e","quoted":false,"path":"/","max_age":31536000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"sh_visitor_id=anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e; Path=/; Max-Age=31536000; SameSite=Lax; HttpOnly; Secure"},{"name":"sh_session_id","value":"anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e","quoted":false,"path":"/","max_age":1800,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"sh_session_id=anon-7fa0f4a6-61a2-478d-80dd-7aaa2ee3356e; Path=/; Max-Age=1800; SameSite=Lax; HttpOnly; Secure"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":94,"size_decoded":1189,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"8d7ba80ae12efdb85ac028385641133d","sha1":"82ee33c5a3f7da9086ee423fb7a0ed7ac53e03a7","sha256":"cbf5b4c620ddb04c8598a47068dbb6927356a215fcf94644ee61c50544397c8f","sha512":"cfec60b540bbe5c7194f75bcd24470fe75ca4c89700b1296f2107e54a067d3b55ad2855db4c0fdf7308e5ff165c3dcc46a40dbe9995a164da08f1222e7d07e32","ssdeep":"","tlshash":"d3b01208404c46354888141c27007e084f7d5173d600d490759dbd4861a248a1d78083","first_seen":"2026-09-27T02:38:55.510482Z","last_seen":"2026-09-27T02:38:55.510482Z","times_seen":1,"resource_available":true,"data":null}},"time_used":336,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/heroimageurl-1785868030521-54705-0-702ec25c92d3.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.118Z","timestamp":1790476695118,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/heroimageurl-1785868030521-54705-0-702ec25c92d3.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DfIpOFnNxBYg%2FMba9YKaPrQXHUja7EqVD1c5FcpoYFElj0iLA%2BlHMoAFqBhxG7Ce4JHvAASYcwQrjLtf7n%2BLXK%2BhjRHYWAwPTs2xlQ3h0Fqrw1WWbjuZA8tiOuy3NtUH\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"c4e3632b02a5585560f3ab62e38fb06a\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 410788\r\naccept-ranges: bytes\r\ncf-ray: a41721907a90b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 62658\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":62658,"size_decoded":63557,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1a2c9f532a37f9a5c8d7e53623b89179","sha1":"c130c407ed1f4612ea62e54ad3fd516c4bef1322","sha256":"b338e781d5e2a2abb2b4307f900e44410289879c33bdc0d586acf20b900d83a3","sha512":"f802d74c9ec63e4f52d36c79b62e0af8d7c8303fef5b13623613cd01d185d84afbda4da69387e644edc59b3a60e3aa5bb688997764a0267dda346708b23046b5","ssdeep":"1536:45NE7rjk1baXq1vQfJwHIL939Js6TS/5OCNrTkI/5:+E7rg1+61YfJXLtEDZTkG5","tlshash":"7b53020323e232c4ccb200be35d5aadb5b91c77d44d6a719e3dc61f906c99ac2a19d6e","first_seen":"2026-08-07T08:55:04.726848Z","last_seen":"2026-09-27T02:39:59.948153Z","times_seen":6,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/hero-b41a65425f5c.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.124Z","timestamp":1790476695124,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/hero-b41a65425f5c.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MnGAoolNlAZRtqJVfqYwbRR4njSxzLuevjR%2F2RE3TaRtW%2BAGjUorN5OTtTqzRgK3maM%2FehDrq3ajsk5H0SgntAOLDeQAliiozkxXzBdJaxxuPXdbNakUyjt%2Bi5ZMt71g\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"e1147db8fdfc8dd7e7832bba4a8cfbb5\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 410788\r\naccept-ranges: bytes\r\ncf-ray: a41721908a93b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 36428\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":36428,"size_decoded":37327,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 640x420, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"24df3af12902652766cd5e0a158ba974","sha1":"5f30ccae1ae144c5d88d6592c7b71a3c5060ba08","sha256":"25f3c1fb4ff94ad93083dc84f03b7aac81e2991db637ccef5884c9fe12fe10b0","sha512":"4ad809337cfe07e2b59f616b567fe8afc3d4a992d9e575942ead75cd5422192570a7633831c40a56653f6b0ed944e3dab1c62b052d8b24c7c492abd4477e40cc","ssdeep":"768:Apx/0KQlI/Tz+C/Zt8HiMjv/fyWZYk7ZjapfpOzzHsLhBYDCxUkp:A2SvTZPUYqeKbsLhmW3","tlshash":"fef2f115cc6f46c57c1afffb49ba449b280ae73ae59d8d52f4c84c435a6287842e2339","first_seen":"2026-08-04T01:51:58.184931Z","last_seen":"2026-09-27T02:39:59.954528Z","times_seen":7,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/hero-eb7a509b6814.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.125Z","timestamp":1790476695125,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/hero-eb7a509b6814.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gFPVyfIrkg549QYtbdDNOTcW%2F8asxPKVBz8edeupquvzmkMhOLVUm%2FIQ1B2n%2FL2jhCufEoEA%2B%2BFEPcIWX1LONt21pq7hZ9IH1eSFFj%2Bu1%2BLdHKmgF9kfLtT8mTVi3pP7\"}]}\r\ncontent-type: image/webp\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"3bac513599aef17f2656e87c2fb1d523\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 70901\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\ncf-ray: a41721908a94b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 38880\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":38880,"size_decoded":39784,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4412c9a23af62f85c7d54656131fc1e0","sha1":"ff7297dffa1895c24a7da81b3dd74e8add59561d","sha256":"ca1cad7291031ece74a06fa87d0216816e305f7d21bcebfa7beeacdc0a88346a","sha512":"a5445febefe125826902345dc026df90766004682d11660092b4864c114abb8ea8e297cc7c88762626b76ed9aaa9f8efaddd653328abb8bfb679b1feaf25e99b","ssdeep":"768:zUDD4kFqGS9L+O3jzMuhhtDPuCaip+nfcLf4sDorw4+W+T0MZmqwJZkQZO:zDvpLljzMcCpTfUDorw4+7T0MZmG","tlshash":"6303e14f69a384e6e2f1402a4c8e7d157a60f46ba731f5210fb5c82bf1712e8751bb52","first_seen":"2026-08-04T01:51:58.185885Z","last_seen":"2026-09-27T02:39:59.941758Z","times_seen":7,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"siteshub.io/api/email-leads/event","fqdn":"siteshub.io","domain":"siteshub.io","tld":"io"},"ip":{"addr":"104.21.94.140","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.490Z","timestamp":1790476695490,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"siteshub.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 06 Sep 2026 10:28:26 GMT","end":"Sat, 05 Dec 2026 11:28:12 GMT"},"fingerprint":{"sha1":"70:9E:80:84:2F:90:F8:ED:02:12:53:82:E9:47:33:2E:18:E0:37:6F","sha256":"3A:CD:76:7D:1B:47:19:E2:41:E9:D8:FB:DC:8B:FC:7A:B9:4C:2B:EC:7D:E7:12:44:0A:58:95:86:29:3A:DC:97"}}},"request":{"raw":"OPTIONS /api/email-leads/event HTTP/1.1\r\nHost: siteshub.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://norainbet.com/\r\nOrigin: https://norainbet.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 \r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\naccess-control-allow-origin: https://norainbet.com\r\naccess-control-allow-methods: POST, OPTIONS\r\naccess-control-allow-headers: content-type\r\nvary: origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-robots-tag: noindex, nofollow\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rbYwgD3OGtfpO9ujN9vl2Iwuthg3%2FWc1VG4pk4wRJl7j9xaksq8HAN8SwJjXbi4cswDdJhou9cB38BlNw6Kyh%2BfIQnOA4Ha4g4We%2FwYY23whT0O%2Br%2Br6G4dP6zJ1iA%3D%3D\"}]}\r\ncf-ray: a4172193398a23eb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":780,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-15T06:37:44.498989Z","times_seen":19115586,"resource_available":true,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":47,"connect":14,"send":0,"wait":232,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-27T02:38:14.516Z","timestamp":1790476694516,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Nh8U%2F8Z5BmmRMxpXO7MJgOI8Z9saDykHT2r9IE24W0sKexIW18tEW0IV8qEij0wqo94XfgJQOylOJ9YurOQpEtmyU32ZdGfOe92O93iV5M5c1P5BEIEGpXu9Eu0GR3zB\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/html; charset=utf-8\r\ncontent-encoding: br\r\naccess-control-allow-origin: *\r\ncache-control: no-store, max-age=0, must-revalidate\r\nx-frame-options: SAMEORIGIN\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\npriority: u=0,i\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\ndate: Sun, 27 Sep 2026 02:38:14 GMT\r\ncf-ray: a417218d8a78b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":86603,"size_decoded":15689,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (3993)","md5":"4867f3cbca00795a1d2d7e64d7632555","sha1":"0eaa10bc3376b673b6553ad00458ed669b45f32e","sha256":"00fa683661cb8ca04a304a4f62b41cb530177d1507459ae9f3e0b020651f9180","sha512":"e95776b86bc40a90ee8356d6b6afc92ded051a987a336cc2147ab70ad6934c7f471005a5dcdc025a90e64d864c29a7b7a72936cf955a764444dd2a57d7287bee","ssdeep":"1536:3PDKJPhfwxp+JdylWqL8fd+nWBfZHGYaorMtZHWedG:3PDKJPhfwxUMG","tlshash":"7b83731da1f43f3e253701a7e9193b2e1239be87dd1e18a57aed44a00f82d6db837644","first_seen":"2026-09-27T02:38:55.533386Z","last_seen":"2026-09-27T02:38:55.533386Z","times_seen":1,"resource_available":true,"data":null}},"time_used":266,"timings":{"blocked":-1,"dns":100,"connect":20,"send":0,"wait":146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:14.983Z","timestamp":1790476694983,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript\r\nexpires: Tue, 29 Sep 2026 02:38:14 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XZ%2FbWTlbJA%2Fy6HPP2WrHPOPd1f9b7sN4BnBET9IvLWJImbhpRtcS%2FDIfaFlA9ypOrJfucN3QHZ4vWS0JVJ%2F7HkwgWHNSBVS4cZMjlpESoGVYi3hEGdRJuuj3G3D68SZx\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ndate: Sun, 27 Sep 2026 02:38:14 GMT\r\nserver: cloudflare\r\ncf-ray: a417218faa88b517-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":1234,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-10-15T06:36:48.481088Z","times_seen":455211,"resource_available":true,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/screenshot-1790113292248-b53ba69398e1.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:14.996Z","timestamp":1790476694996,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/screenshot-1790113292248-b53ba69398e1.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wV2rrmf5tWGFFOmprQuSmtUInpxnB%2FYWtej6qPgqFBGlnUnRMEc3N3eO7hd9r3uMRrtQ6nuZJJjlch4bVVPUdFbC8tvu549dtTUZWwit76zI0IrBIEcYw4Vtj3RnAAQ2\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"a6da0ebf81070ff663a8137b01462e59\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 93322\r\naccept-ranges: bytes\r\ncf-ray: a417218fba8bb517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 124692\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":124692,"size_decoded":125585,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1600x783, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5f9f12659dc1003522774a327082cabc","sha1":"2fc557cf7ffaf6a0293aa84f078d91364b9d1734","sha256":"508968572397d53f489c4f21e79efe25e5c4476594f8b3ff071d5936ddcd66cf","sha512":"64af4377af791569c4152d03cc83e4e7f91d950c5fa774169e64131e2cc2e5a4c202f49153a9b297ccd2f44e607dc4d01231d1def8c88852e5ee23180d838b83","ssdeep":"3072:ng5j104zD+D2ZYnCm1z4sDI19vRwNpAyHqMPKujxZLji:gh1A2lazL0RAAIqUKax12","tlshash":"b6c313765b94d609ecf97b630a3167ecc1377b6f24cc88987d138811e54bf26a70a702","first_seen":"2026-09-27T02:38:55.54168Z","last_seen":"2026-09-27T02:39:59.947267Z","times_seen":2,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/hero-be32c8b0a9fe.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.129Z","timestamp":1790476695129,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/hero-be32c8b0a9fe.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6borfcQfUfgQIDlmGQ7crN699piheH2M5L2DfBce%2FIm6vWjT3zgiZfnvn%2FotdHkgY5wG4oWQRUnsUB%2FQ5qbBZzsQREx5GQ5eZngDOaqmjRvSwJzu%2Fyelgs%2BpBprYnmAk\"}]}\r\ncontent-type: image/webp\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"05db0c40365f9cc6242d2fcab9c37477\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 70901\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\ncf-ray: a41721909a97b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 49944\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49944,"size_decoded":50844,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 640x420, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a1df0f17bea99c18425e5e21468fec3e","sha1":"d3d677c65d069527bac2b61abcc528e550621d7a","sha256":"d79f5333f8ea66dc25750df8bf17714f3ce7fd3b297703aed6f20eafba2670ab","sha512":"c6ee473300da4e6864e29694197a6e4d769ffbfd4a6aef799755c46801438fe623e00fd0f9b3395b2c52c0614db37bcb8a131aadf308fe541b7993eaac243f95","ssdeep":"768:kw55nJHv2JVBOKwSp+pSO8eCSXLPmMo5eLX7VzrwkqGM1DCkZTxDAgxL1m:P5HvgWKwSARJtXa3EtnwkWmkZTxkgC","tlshash":"5223f2dab2e61a1dd45245e71ef049b5b259a1c623b0a390f30703567d42af98a8f7cc","first_seen":"2026-08-04T01:51:58.194991Z","last_seen":"2026-09-27T02:39:59.94942Z","times_seen":7,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/hero-01111a1a2911.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.134Z","timestamp":1790476695134,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/hero-01111a1a2911.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=69zAFinISkbWsxGAS4F4mHLQDo98%2BG%2BEB7ShXu03fHF39qLyVhLT4h5iF6cN2v1G2nKcvkhaBRNjvOlvzsMpgdzmxE0dr74deSr61UTkiphBlSPirbA%2FrI4pBmJaCdP%2F\"}]}\r\ncontent-type: image/webp\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"be8cdc866f1e910308eb7137d195f787\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=4,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 70901\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\ncf-ray: a41721909a9ab517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 50672\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":50672,"size_decoded":51570,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1098ca725b4de94943212e24f74c5473","sha1":"6df3bfcee924babc62854d34aac5730512f4d30e","sha256":"1499631e2eda1be0cae2ddff1a079e94613c4ed9119a8bbb17b55c8a5fdeab27","sha512":"0d86c67ad51041ebd14e42c106913974418822c56d66f04328e2cdd4a45b57c94cf3074085582882624daa4ea4f3973b7ef9df141dc05149d9c4a112de99b7d7","ssdeep":"1536:l37PJxrEJmXjgjxtu1EXPT54Ic7u77DgrlCdWU:ltLENtu1IGvuLgrl","tlshash":"2c33029e47278b327fe467e99ecfe1e6a73408308b814b50c7a50be8e401954593f7a5","first_seen":"2026-08-04T01:51:58.196873Z","last_seen":"2026-09-27T02:39:59.950242Z","times_seen":7,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/favicon.png","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.562Z","timestamp":1790476695562,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: siteshub_consent_norainbet-com=%7B%22consent_version%22%3A%221.0%22%2C%22policy_version%22%3A%221.0%22%2C%22timestamp%22%3A%222026-09-27T02%3A38%3A15.159Z%22%2C%22preferences%22%3A%7B%22necessary%22%3Atrue%2C%22analytics%22%3Afalse%2C%22marketing%22%3Afalse%2C%22preferences%22%3Atrue%2C%22functional%22%3Afalse%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BDDAT3bY%2B9vVovIL9eWoBQYLyQKaQB073EfTIT4sDGCtvZPkQy%2BLqXzREWvUAcY%2F36QQkdlOQgxc%2FHzYr3jh1fQMDfPZWzNepY2lbDI54MK%2FWqqRe4S%2Fg7Es1VyXZGCf\"}]}\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400, must-revalidate\r\ncontent-disposition: inline\r\netag: \"3a582e7e121b779792b7d4429aefaa3e\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=6,i=?0\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 70901\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\ncf-ray: a41721934ab6b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 33054\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33054,"size_decoded":33992,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","md5":"102a9399c94ffe5f36fe475d3d032ee9","sha1":"7d4cc7353fcf5a19151d0a8e910f5d9ae2a0b079","sha256":"39db6f249685d55e95a93f5241eea7eb1446c7668a26aecbb9ed87cbb29c74a0","sha512":"15c49ba50a5cd2ef2ea1445facd88df95eab97a3badd91e998bfdf345da8be1322c498df9762d1141bd2612135db5948b3e35512a0f18548607b5d5bb2d2a801","ssdeep":"768:4Mj+pWfitWzNyiUzyugylYkygTaNf1DLZk:4ppWfdHPcG3DLG","tlshash":"fde2f1ad63d325a4194500b5e3cd117fe16326b20fb469073ce59e6da03223edb28fa7","first_seen":"2026-09-27T02:38:55.559477Z","last_seen":"2026-09-27T02:39:59.942521Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/favicon.png","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.563Z","timestamp":1790476695563,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: siteshub_consent_norainbet-com=%7B%22consent_version%22%3A%221.0%22%2C%22policy_version%22%3A%221.0%22%2C%22timestamp%22%3A%222026-09-27T02%3A38%3A15.159Z%22%2C%22preferences%22%3A%7B%22necessary%22%3Atrue%2C%22analytics%22%3Afalse%2C%22marketing%22%3Afalse%2C%22preferences%22%3Atrue%2C%22functional%22%3Afalse%7D%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BDDAT3bY%2B9vVovIL9eWoBQYLyQKaQB073EfTIT4sDGCtvZPkQy%2BLqXzREWvUAcY%2F36QQkdlOQgxc%2FHzYr3jh1fQMDfPZWzNepY2lbDI54MK%2FWqqRe4S%2Fg7Es1VyXZGCf\"}]}\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400, must-revalidate\r\ncontent-disposition: inline\r\netag: \"3a582e7e121b779792b7d4429aefaa3e\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=6,i=?0\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 70901\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\ncf-ray: a41721934ab7b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 33054\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33054,"size_decoded":33992,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","md5":"102a9399c94ffe5f36fe475d3d032ee9","sha1":"7d4cc7353fcf5a19151d0a8e910f5d9ae2a0b079","sha256":"39db6f249685d55e95a93f5241eea7eb1446c7668a26aecbb9ed87cbb29c74a0","sha512":"15c49ba50a5cd2ef2ea1445facd88df95eab97a3badd91e998bfdf345da8be1322c498df9762d1141bd2612135db5948b3e35512a0f18548607b5d5bb2d2a801","ssdeep":"768:4Mj+pWfitWzNyiUzyugylYkygTaNf1DLZk:4ppWfdHPcG3DLG","tlshash":"fde2f1ad63d325a4194500b5e3cd117fe16326b20fb469073ce59e6da03223edb28fa7","first_seen":"2026-09-27T02:38:55.559477Z","last_seen":"2026-09-27T02:39:59.942521Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site-s2d10cd98.796a8ea99ee8.js","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:14.985Z","timestamp":1790476694985,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site-s2d10cd98.796a8ea99ee8.js HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uH%2BUYRJ2vhV8agMrLrak6BOlVlEIaBA1KktL8pc%2BBUWDJ0KSRUzaUhNphqIsGAiUbU%2F33svxiNclQv5niz%2FCSscpgrYmATshY%2B2lMI9SRGSJe%2FVI2j8AjIVAF79C6AVp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\nx-frame-options: SAMEORIGIN\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\netag: W/\"a72953cdd67918c4e6d50f767a4c449a\"\r\ncontent-encoding: br\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 93322\r\ncf-ray: a417218faa89b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44427,"size_decoded":12353,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (3161)","md5":"1ac0243fde7b64454492d6405172d42a","sha1":"0b12a1e6ba1e0ae8da84324ab82683634af5f06f","sha256":"fde541962fd7ef73937bb532b16a7f8b5f7e0bfb76bab92615e699bc7270363a","sha512":"18538e6995f3ef047d0dd72a91af047432fcd60bb23d370b67ab6d95d502a8ca10aa1430efbdcdcd81e61a0583fc8ae42131b0e1c30acbb2e5fb92eb2752713b","ssdeep":"768:j5uQuls754Vj7I7YPf/6WCs502F8dxJK8FLDKqqBmP5w4DvLyLhMsA03LQ1+N7aj:j5u1/IshCs+2FqxY8FLDKqqB74DvLyXk","tlshash":"b713d6ada4e216b647bb21fe9b9f578572316167d00ac8103d8c99c41fc0a1613fafed","first_seen":"2026-09-27T02:38:55.56111Z","last_seen":"2026-09-27T02:39:59.952048Z","times_seen":2,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/hero-35079721ef0a.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.120Z","timestamp":1790476695120,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/hero-35079721ef0a.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hu2XZqpLxlnsgXrJxDaeyQEIRETyes65HMo%2FP0INpJE%2B4L0NNP3MrKJgK4c1xJPVPlN75Q7TMe1%2FhwVoWyRnXu5vxf6o62L9GaiSOKbSALJrlGns4g1zrpAyT17dPaKM\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"af83dcd77e5fad7950b95dec66540640\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 410788\r\naccept-ranges: bytes\r\ncf-ray: a41721908a91b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 52544\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52544,"size_decoded":53441,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"772ee232349598f4f03479f9a9a6b1e9","sha1":"1bfdc73f46b43e558b889356c348febb51c320e0","sha256":"52133a37ea42b54164bd98d00591b1fcca9a5f39a3c5b85e58a04194ea64e3e8","sha512":"d6ffd7a033721164e9f4775e8e2d6d1359ee00edf58708330ae504eb66c5e6ee72a83ad9d9fae66504ef46b7ae3417b971f81cf4713e80aee3ce70e259ed9898","ssdeep":"1536:gZ8ZbeRJ2UycuQrPNb84GXZqPXpyIQDzWLjRn:ZZirHF5PcICzy","tlshash":"fc330263e8563ab9948e8cd4c783e8228bd1d1fdd6fc23d10b7ef50b1660a650a27479","first_seen":"2026-08-04T01:51:58.193011Z","last_seen":"2026-09-27T02:39:59.941177Z","times_seen":7,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/hero-872235475978.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.122Z","timestamp":1790476695122,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/hero-872235475978.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SreTneEzhmSZ5ln1Wo6SGpOJ9s%2BEEdIBqM3u5om0nrRioIM1Sw1mEkc4mMHLeBE3jf77yJhv6WxAeNXvApY%2BjplVafX7SZKFQPcOUTFCVXPxY7%2FknV7cwY5EqaqSLg9L\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"bff985b839b7313e3b3a25725540b796\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\npriority: u=5,i\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 410788\r\naccept-ranges: bytes\r\ncf-ray: a41721908a92b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 31724\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31724,"size_decoded":32621,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6da1c9bf928165d2587cedebfefe55ce","sha1":"6bb2471a2a8d3233ae6879ba99d01e020cf29fc5","sha256":"87ba11ab5f5430050861c109c800dfcbec701d54bbe7068749a1ddb22a3ff7ba","sha512":"578d3aaf2fdd58207784ca5b889e354493936634aba1c0403383282c4ac1c1bd6e730f04dc3290e75439c7d56992f095b016cc2d3e320d1f92140dfeb80c0752","ssdeep":"768:N4MZD5E3jVWnw+aodfnn79vIi+Ml+7QG2hCut:vZtbwToB1Ii9LHCy","tlshash":"a1e2f1f0ed9052d51307242b9a567e4d3c81f278afa532d0cdc4942d76e6299f7f8710","first_seen":"2026-08-04T01:51:58.181441Z","last_seen":"2026-09-27T02:39:59.948741Z","times_seen":3,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/hero-96b104481cc0.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.127Z","timestamp":1790476695127,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/hero-96b104481cc0.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xz6B%2BjGMOPjNZUVao%2Bq%2B2BW0L9Zrj1xCG2vziyLKCw7CONHVJ4LCNSG9bXjcCHmb3aIw%2F2%2B18sFdaNW%2B%2FFO92fsu%2BBbRAXI%2BlX5DKfYXbcPaczTU6NbNpbKyGMUgd5f4\"}]}\r\ncontent-type: image/webp\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"7915070fc481decd1108115e52c0757f\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 70901\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\ncf-ray: a41721908a95b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 50202\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":50202,"size_decoded":51110,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8b4425b963214a05b956a8407daa736d","sha1":"550ec608b8d420b120dd877afec3c41dae4460e3","sha256":"888ae36fb76cf7d47ed9655e070a3ec8d6265c2294ff7bb394ec16e81afb3368","sha512":"46d7b6f33de12c4f38aeae5a7304fc9e8fbc865b74286ace263c77f02ab8a6b1c64033f919317f7b488c712980578f9f3fb47f72b67530bed2ea506d474b8341","ssdeep":"1536:XZ8jBrivMk3hnCgcA24dBqsjCtpojIUvtHSc:X2EMChnCg3PLji2IUv9","tlshash":"7e33f1f76a33e11aa72297279175c34a49ff1c3a390bfe3987233683c7504961e57581","first_seen":"2026-08-04T01:51:58.188359Z","last_seen":"2026-09-27T02:39:59.936366Z","times_seen":7,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"norainbet.com/assets/site/hero-c4baf714c6bd.webp","fqdn":"norainbet.com","domain":"norainbet.com","tld":"com"},"ip":{"addr":"104.21.38.223","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://norainbet.com/","date":"2026-09-27T02:38:15.130Z","timestamp":1790476695130,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"norainbet.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 13:44:13 GMT","end":"Tue, 03 Nov 2026 14:44:08 GMT"},"fingerprint":{"sha1":"99:9C:4D:C4:14:5D:8A:3A:0A:51:FB:AF:D5:76:83:A1:A2:CA:11:78","sha256":"C0:47:78:42:CB:11:83:56:60:A1:04:41:B4:E0:8C:87:80:D6:12:25:28:C8:0D:30:38:86:53:BB:E2:A7:0E:91"}}},"request":{"raw":"GET /assets/site/hero-c4baf714c6bd.webp HTTP/1.1\r\nHost: norainbet.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://norainbet.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Vse0Fn44fI6bh23LIfu%2FA3R%2F7TDsIAqCUlutkm12qmkDAYA5sA0G1FxXTBIVe0nXPrbu40GtNmfcdBZrYn1JJimZQxjGnBjQXphmBMZRfxmc6gvpdKIiecDE1P2v3UVA\"}]}\r\ncontent-type: image/webp\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\netag: \"2b9faf9fdb02907b819995966a4f33fb\"\r\npermissions-policy: camera=(), microphone=(), geolocation=()\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sun, 27 Sep 2026 02:38:15 GMT\r\nage: 70901\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\ncf-ray: a41721909a98b517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 31608\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31608,"size_decoded":32502,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 640x420, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9891664225118f47a76fb6f7bac0e2c2","sha1":"d29c7a500bdf536199cf6461163a590782fb5261","sha256":"2eaaf3eac889a8bd6bf24be304cebeda183ae054be2d877a218a7444dbc42784","sha512":"49acc767f5e435e0cbd9c9abc15e2a6c83c38f9ebb8dbb771a9b928a09b1bc1a9d65df55ef7cc9b57b7c01c627f9babc32f867a7a93a1ae25732c17324497e60","ssdeep":"768:Re2Y1hk8eX9uh1idHlRkoZzX84o8vEHvKTVzr6PCsTj05c8:Q2Q1iIeG8cWmP5j05c8","tlshash":"16e2f11482e127da5e4c3ad0dd647302816dfb5cc61313f76351b6dd75b73a83a8158a","first_seen":"2026-08-04T01:51:58.195891Z","last_seen":"2026-09-27T02:39:59.955682Z","times_seen":7,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"norainbet.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}