{"report_id":"7b4d392e-7947-4a2d-be81-640ff34797e8","version":0,"status":"done","tags":[],"date":"2026-07-18T17:14:51Z","url":{"schema":"http","addr":"rainbetee.com","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"104.21.57.200","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"rainbetee.com/","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"title":"Rainbet – Eesti Parim Online Kasiino | Boonused \u0026 Mängud","dom":{"size":51399,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1442)","md5":"9b812e7ec159887c730733b59652ef1e","sha1":"1d514212762c4279a15d5074e2485f6f305b8d36","sha256":"9c1a68213e171853a9ac81e405893a8bc7a87c63a3537aa6d9626826177f419e","sha512":"81d72312f6eb2b769a3d3c6d792d8a4f6c4e2766fd80eef5c017e1198e38a4b1cbc5f246a2b44e18bb4621c6883318cb54c39bb3136bd11b2048e1703d268f05","ssdeep":"192:9243/MxOOjc8c/NVPqghkGu5Yv2GBaZSSF+auRLX49Z4LUoUjG99yeKWjdn/qd2O:P/uOOC/NVPMXy2GBybqSsySqPFduR0","tlshash":"5433b71360f5502712a2d6e59d20af19fe82c01bc91a8e55b36d839fefd2e418de372c","dom_hash":"domhashb6e79952aef99047346d1c97bc0bf444","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rainbetee.com","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"104.21.57.200","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-22T17:14:51Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"rainbetee.com","ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-02-27","domain_rank":0,"first_seen":"2026-07-18T17:14:52.250685Z","last_seen":"2026-07-18T17:14:52.250685Z","alert_count":156,"request_count":78,"received_data":1604691,"sent_data":39412,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Twenty Twenty-Four","description":"Twenty Twenty-Four is the default WordPress theme for 2024.","website":"https://wordpress.org/themes/twentytwentyfour","common_platform_enumeration":"","icon":"WordPress.svg","categories":["WordPress themes"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rainbetee.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-19T05:20:13.312769Z","times_seen":400431,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/themes/twentytwentyfour/script.js","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"82a749151826c8176e1977c356b02794","sha1":"aa9694f7ed21082c1d33f3941ec37791bf569820","sha256":"3263c1713234dbca904f3f7a97e1065755c54560ebcd14243403f8383aa87df0","sha512":"9532794b46ab2160b0cb39dac327ce8469b97682e488f9cffd8b2ec190a330317842915f8da5fbe9041219a3e67036845d14398491beae49522f509b9682e6b1","ssdeep":"","tlshash":"96113428317655762137b2af67df8694322020cbe445de963e7c8a462f91ca504f0fee","size":1071,"data":"","first_seen":"2026-07-18T17:14:55.577541Z","last_seen":"2026-07-18T17:19:30.012336Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/5d5626f563e1440f.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.624Z","timestamp":1784394857624,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/5d5626f563e1440f.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KLayKu3CPXCuGTyMfwk65KV%2Fhj6KE5zpuNc1FE1WVvVoe8X0LNN%2FprESe0tTtvK3PvJvwc1OMe7vGIPnqtrXtfvFklwwV0pG4aIWqdX9N7RrqriwmlMPQFzS6Af4Lsx8\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f342f5956cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6757,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/44dea0557aec11cd.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.626Z","timestamp":1784394857626,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/44dea0557aec11cd.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fy4m7f6VHt6YEQHf2OPHnYX2lmJTeWgFvRFpq27xYslhM4b35eqicLBeUUclb44XY6pebnSsAmlC1UYmOnKIMhLkOXjQ0NzESShmDjNNDKXt%2FzRqhTfuVh6lSP7U1q99\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f342f5b56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6755,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/bcc9295700cab20b.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.447Z","timestamp":1784394857447,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/bcc9295700cab20b.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oFxXQCr9X1Mx5CnlLasrI%2FTCmoEOIxZaaOUQxXt2JWptR2HAG%2B19ZRTqcms2L380WO0qmjXZkfgIrIt%2FW25rtbH%2FE4mnQGUYmz9iTVc%2FOMhLzRpB94sHBhECu31pkxpP\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"8c7efbac99604082c396fe904380207a\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f330eff56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 20085\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20085,"size_decoded":20893,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"843e7ebe7ae17cc10b217375329e6b6e","sha1":"c9af7f7b6cdae180879300fe0082fa4f0a60cb1e","sha256":"04730aa6b3992201bd4a7bc814c13ce6e2c0284fd9e9b72e2cc26a6bf848c249","sha512":"7bf7aa0f53c071422f0ec81016152dcb0bca6d6e3a9e87aeb07801e2db3975978330b3a0c458cdb9f84d8d0a2d5cc1778348ef3d7c7cb1fe5caa10955c38e66b","ssdeep":"384:u7Jvi24+5ngrahcAICsgp+PLXUCKpbeuRXSAM7X91cZvwYdksfQBF:u7p1XNge7p+gCKEUSj/Od5oT","tlshash":"e092bfee3fe096817c366e7d83916204f4e2b8ddc18e48538b3586138edd9c437252d9","first_seen":"2025-10-12T07:48:56.639825Z","last_seen":"2026-07-18T17:51:04.631537Z","times_seen":52,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/780635b6ee8c1443.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.456Z","timestamp":1784394857456,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/780635b6ee8c1443.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nWN%2Beo1O%2Bnw9Pg68RGPOB7tfO%2FfeRjge23ZFv4fEpZg4guIRPva1qQsJh1WPsAQMW%2BzgYko8mA22vZ26lxOUv1CtyRMxxQrBbDnXyAysiaJMaoTTaLYQQAvd1mPCoeR1\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"f125bd93b869a14c11d148d2a42afee4\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f331f0c56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 21778\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21778,"size_decoded":22584,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"730b2d8168e5666da11f10561fa2727f","sha1":"5bcf4a2b9d87af29865764b13a1e3825851c4388","sha256":"2be30e062ae7482f87c8d50cc6568df7ad3c4cb247b1550b35bf8292837678c6","sha512":"ba5f47ddee27e0f818f21117e9faa61e98422412ab568873c36b0edcdc6ac31775677f83252f2fe40e5f07d647f128b2c1c2ded8a6db9a6dcf6c6a96b9ab3f72","ssdeep":"384:HF2AYV8ULedv1+k4OrxOl6AjmPwqYVxjMP3Zs4gJnukoVKca2lbYgXkaWdQpsvXf:EAQ4J1+KxOMAiPUxIP3oPCKcNboaWcsn","tlshash":"fca2e1d9a7a2d7c2e3a19ce5688d1e2a00506c18265f793c50b1cc2e95743eb92e0f7c","first_seen":"2025-10-12T07:48:56.698277Z","last_seen":"2026-07-18T17:51:04.63327Z","times_seen":52,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/5d4b5779464e2b40.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.457Z","timestamp":1784394857457,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/5d4b5779464e2b40.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iZmhXheVzXyUyVwEVOwZQIhT06qFl70qk4IaECejRmqgysF06DcrlmWKnRIln8w7icBde5btn5hQxUs13qvMBX%2FoM1fv6or3nh421GYFd7k0yUrdSwn4qVcrjCtnXM37\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"21f8a3aa40e43fe563885b84995d54b9\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f331f0f56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19565\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19565,"size_decoded":20365,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"79ab9a51578a15bae5fcc273367f4df3","sha1":"65d62304507516c239a0f6e77e3c68ac53d79a44","sha256":"b5f51e3882841d3ebdf9a83a0e5ee1590ac4b7a6ee08bc240f1bea03a68d6d10","sha512":"aca431c380aed4fa232cb0eb799ad059d5ae4c240aa4bcc7f17e89faf4e6d13a68a26d90fcd46e9a21ba0def297de3db418ea1eb571d5d635d4848acb4d54017","ssdeep":"384:Jgp/BCqYuEjIxy4bkToQQ7+0xsAK1YyZ/uFCeHKHQaKvDD0zNS8VHfZWJOXhN2N1:KpEq9o/Tof7nnEYyte9HKHQaKvDQzNSj","tlshash":"9792d1e7e1279688b90b4d2b54210f3424f4ec872bcd1598bd3fdda6e1796d85a0e08c","first_seen":"2025-10-12T07:48:56.661326Z","last_seen":"2026-07-18T17:51:04.616491Z","times_seen":52,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/a535f25ec37f13b6.png","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.475Z","timestamp":1784394857475,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/a535f25ec37f13b6.png HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YorYdCZ56U21mz7qxvt4l7%2Bbi38CzcOPWH0j1V%2FVS6rMlVAdUpXqksDlwF8tldiu010zgH1ZGNurPq0D%2FMOOgB6IXSCVOR7bVnl6Sz3wiW9UiQH03ySWRjinoG36AE8c\"}]}\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"7fd4547a3c9d59afaf332063de29e0d0\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f333f2056cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1834\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1834,"size_decoded":2636,"mime_type":"image/png","magic":"PNG image data, 112 x 53, 8-bit/color RGBA, non-interlaced","md5":"b0e3ac9ebab6af5f48091dfaff855a54","sha1":"096de8f22039486621f167862d3cdd2f7d6d6a6a","sha256":"fed91cc5540efbbafc70f90d761c9caf1855a43f9ac0abdf58b43020bf1fca76","sha512":"6383332e70343cc4f6be1510e793ff8416c9a1d2de0b6e255121026683a162cb12075e2e41f0074d0eac618390f884a5365716cd50c2a1842b0b2dfe2c7439dc","ssdeep":"","tlshash":"8731094ebb253d6f55fd6e3d47245434a43f98bf3454293ce87745085ea520f60075a3","first_seen":"2025-10-12T07:48:56.729773Z","last_seen":"2026-07-18T17:51:04.63383Z","times_seen":50,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/e8bf5012bb8517f8.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.591Z","timestamp":1784394857591,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/e8bf5012bb8517f8.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yjLgb9ivBw8qRiss1E4QFAkf89kp%2BRMFdB3siYuSCsm0SFExnx8g0hjzjgGXSUhVWZSpxD2Edrph%2BzijFWZKa045skGIO05oKrdC8DTYAhhG9FprS1wH44Qc1DMqWVVa\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f33ef3a56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6757,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/3c63bffa0fb67f73.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.603Z","timestamp":1784394857603,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/3c63bffa0fb67f73.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gBZhxoMG0gnMQO0tXkFijJCkcRkJ1KtUxezKa8a5NPhylCzBp1qYfyDXopSZlyTJZu9aN2UaEXnO6AWhGp2MwsVQDFrIulHqaikEtEg%2BrsJQQWZ%2B68cM4jXEgt7AHCxY\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f33ff4456cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6757,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/8458bb82f37537b0.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.616Z","timestamp":1784394857616,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/8458bb82f37537b0.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HmpPozcQqB1hGMOHv85B0qIqRw6wjGG3jaZ4Q%2BavW%2BUEsao61ifFgEP1orwU%2BFnemQFG4dXlR8rdibMUeAKSisa%2Fv8EOt0qeSwG2VzvxvaAFzGamsRXRMdJua%2BwB5Z2L\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f341f5156cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6763,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/151b2bf54997c0a9.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.629Z","timestamp":1784394857629,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/151b2bf54997c0a9.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TaLBeI27enxFRAF8GhQtF2ubk11rtUJwm%2F3S9CVI9WkDTG%2FiH%2FZvIl7Ht%2B4%2FYLz14IySBnEXfK4CZmsUNquv7rAs9urJWxZvC9jdcjyE8swqnC8xwbvt%2BZ0WfuGf0uj8\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f342f5e56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6765,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/bbe2ea63204ca711.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.461Z","timestamp":1784394857461,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/bbe2ea63204ca711.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=G98WiuXrvQxYgbvWrmASyCnJHDtMQeyPuC2TnTsGOLfCdP6FZCgVEydI0DPLbxHmxYI1z8lF3Zpv5k2t0VMLLacCsL9j92eZVU4r4gkVybORDN%2FTWdCEOE89gCufyAFu\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"9a14c7240c42d1939687214817584f6c\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f331f1356cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19439\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19439,"size_decoded":20239,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"99b163a258ac48343d78700d6ea72dc5","sha1":"07aa77cbd1aea360470fee6fe856e3959cfd5040","sha256":"75bf3f0e7e125648a2b520050637766af0991d45137176a817351410c8a6f2aa","sha512":"05bcbb1216dcb382de98541e11dded74c178571aadf5db7a9401b1303e38ebd45a4f07ba3444173bc7a672696daa1539768a8978e22aa5fe25eb6babae92eadd","ssdeep":"384:3t+0mPOfywn6aUNN4y4mNB5aQMa2RywITq2cXqbinjMJR3/qrRpLmnUvMJ9RbV3:3k05fywn6zp4mH5aQMYw+q2c6bij8RCI","tlshash":"2892d0c6db708b1cb20a4e37a69db41c8f648f106ae50b17137ec42d136a4d56d65f4d","first_seen":"2025-10-12T07:48:56.701589Z","last_seen":"2026-07-18T17:51:04.620243Z","times_seen":52,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/45ed40e8a3ecfed2.webp","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.467Z","timestamp":1784394857467,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/45ed40e8a3ecfed2.webp HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qyKUgSiNRh2rJza%2FGK%2FUj4WOAZTYKZwvVyM8bcqhNCFjNd1uuuX3u0mJfyOfUPe7QAftz%2BnWW4GY2PolLQVgnLH%2FOLEXjOSBtfRl%2FFVgaCdRqy0Zy6zSv%2Fu%2FE%2FHban6y\"}]}\r\ncontent-type: image/webp\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"78e4d82b238d72f71a3c1eda2de7d40b\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f332f1856cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 42616\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42616,"size_decoded":43430,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 400x866, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"323b5f866c85249292a6fb8c99cd9c86","sha1":"2c25a75b4c94067a33ab3e38324cab0a97fa5b67","sha256":"b61ec35c56b4fc213190a74b72366975b5a3be0223c03f539b4025cfec8c55d8","sha512":"bae23ecd07db1d0f7eaecd4d18dfb97fcc8e7cec147dc8d3d1802ebe15e40d72f00d737f1ef8f35e25169bf5ab9366e0ce5b1c90ad841b5d4ff5eee4eae16b6c","ssdeep":"768:epmUOf1iCDJOVoeyREgtsMfKwuwiDhoXuyj1cuf9Z+3IrFzutmTOk:bCzoZolhyW89Z+s","tlshash":"d413e121a85f88e70409c4ee8ebd8f5fbe197d9173c9f691020d5055f2ee991f488fa1","first_seen":"2026-07-04T10:30:55.312615Z","last_seen":"2026-07-18T17:51:04.629076Z","times_seen":13,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/bffa8bb19532e160.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.628Z","timestamp":1784394857628,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/bffa8bb19532e160.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ETynYBeHj4v%2F9zO7%2BkLuRa1NpFATjkkzApBN4G9iHLEgRfsu%2F5us0dq9lWCYc2PnypRbrxBD2E8TfTe4kg6kDpxPYMVjflG3%2BlwcaPHCe%2BZyFiZZ%2BJ97WMGpNINhnTFM\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f342f5d56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6765,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/1bb161fe60d90b65.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.630Z","timestamp":1784394857630,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/1bb161fe60d90b65.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=snpK4qyzRU456K%2BAN4QhEJgAB3sHmgd19tqCBmZCx3uItJiBGjskLnb6wnlUc6jQmHasMZ2ix5VLRMj6a3yS6IV2VMjPlMc%2BO1fFR9bDvCCjiiyX4J0Jfh6NEidFqyp6\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f342f5f56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6757,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/favicon/favicon-16x16.png","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.758Z","timestamp":1784394857758,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /favicon/favicon-16x16.png HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TrhRuwk0ajlDoDcXfIJUikZX9B9CzZnj5j6GMm6zVZRcbaiZEMVNHVmzszXCbKuboOYnDEf40N0MdkBLv7DUiJaPVRVqi7fHi03ZC6aVxYpw6SGZu71I1yGrljYCficQ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"0b75c550ce5aee3fcfdde416ca6d6ce7\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=6,i=?0\r\nserver: cloudflare\r\ncf-cache-status: MISS\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1d31f34ff7556cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 614\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":614,"size_decoded":1405,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced","md5":"d906734e52e8a73c30e8b405e50d1547","sha1":"50a12565824741c17c3093978f9237a1fb4436f6","sha256":"1a71e290862a044efd041002e76fdd541d1eaf1910576cf1011f4939363c48ac","sha512":"e8102e666d727294cd4de8764a02cbb2db543c3a4ed8d09a85f3be4eda8e613dbdbe888320b20709bef9c0f4e184b5a67bcf9cc5a1851d130b79c8f80d921f63","ssdeep":"","tlshash":"c0f062865b2164c7fb468235265f88485489dfc8a440b5196f03532c0874e082bae215","first_seen":"2026-07-18T17:14:55.574288Z","last_seen":"2026-07-18T17:19:30.016729Z","times_seen":2,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/37c7ae20947cc4cc.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.436Z","timestamp":1784394857436,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/37c7ae20947cc4cc.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iVSR86OJN7X%2Bw1XzkewMqtJbjqlHEP42eIqrhnFGzBFVQDH%2BdNnUVeBg8PpW1RRkxcvibG8eLSqPDtHG55YM1l6qqDe%2Fuw5Lx2xVa73%2F9GWG7yLsibTv%2BZtd7D8WSKXD\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"f5ce075ec6757cbf54ff40ed632262f9\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f32fef456cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 26132\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26132,"size_decoded":26940,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"a29cac72ae4520e7c98bb3065a72f6c0","sha1":"bf03f671b834db8a8a9e19d5eb1c9220dcf66f58","sha256":"1490d5de6ef366b7d80ba4bcb9799b6efe2b871dc9590e1d51c235ce01663f7c","sha512":"922bbdd55d377fdea031dfe1349f605adc221c78ebfa624fa4c253ca459491e7fedfbba808ceda456942b2ebf037e9f361edc49b03dfee545b0ff368dcdfed8f","ssdeep":"768:kDTIUwozJ095iRTNoEd89D7rqbOLfa4PdSf:kXIUwKLJurAczdk","tlshash":"34c2e112b25030ab3ddc7c9046a208143df2da3dd5914f9ef376d88aa60e6c4dc3935e","first_seen":"2025-10-12T07:48:56.684326Z","last_seen":"2026-07-18T17:51:04.619263Z","times_seen":52,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/5c728e95142c2b52.png","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.470Z","timestamp":1784394857470,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/5c728e95142c2b52.png HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cfWk0pTV2PuMxkCnQNIbMHEXqS10lxmWzn9jImwbTbfepG5y8%2Bl8M%2FjtzTHmXHgCST27zI1f7N2mLB3Aor1bINlbFsGeClMaZCq59gyws41a4np1TdAUVp66npS9O2d2\"}]}\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"1eb33195bc50f0eea856c28b67291759\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f332f1a56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2428\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2428,"size_decoded":3228,"mime_type":"image/png","magic":"PNG image data, 142 x 27, 8-bit/color RGBA, non-interlaced","md5":"543f0f26c7990d1ced7d1703055457ea","sha1":"b84072f09b2ecc9008e36f80b49733d1a7a783bc","sha256":"d9ece0796556b71b5265008cb2e76dbcfe6df67c3ae0f18ed6c9cf8c8a66f8eb","sha512":"85b9aa85924dec653e2ca2580c0b9862a2a897f3077529bb75bfb13c066cf9e1912131ae42292b814b4fd4c13f974b1aea821d87efa5acf4907e05a2a0e391b2","ssdeep":"","tlshash":"a4413d4b359ff1b1ab64973073567420a42397db1306796c65ba4d0710791767ca0b31","first_seen":"2025-10-12T07:48:56.723836Z","last_seen":"2026-07-18T17:51:04.628091Z","times_seen":50,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/themes/twentytwentyfour/script.js","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.422Z","timestamp":1784394857422,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/themes/twentytwentyfour/script.js HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YdHtRFk6hBFlsuqkrIRomVGf3RAS8PFzm%2BOZYJPQmMGnFflGNa1vjAh40YDiKOVADv9SpOcNic%2F3OnEY9reFy%2BqZgAER7OFaPaMmgT9bQ2AdbQYtGi74XNtX5SRNKY08\"}]}\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"38968c8ae6da1b4eb192f7928ed97b22\"\r\ncontent-encoding: br\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f32def056cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1071,"size_decoded":1220,"mime_type":"application/javascript","magic":"ASCII text","md5":"82a749151826c8176e1977c356b02794","sha1":"aa9694f7ed21082c1d33f3941ec37791bf569820","sha256":"3263c1713234dbca904f3f7a97e1065755c54560ebcd14243403f8383aa87df0","sha512":"9532794b46ab2160b0cb39dac327ce8469b97682e488f9cffd8b2ec190a330317842915f8da5fbe9041219a3e67036845d14398491beae49522f509b9682e6b1","ssdeep":"","tlshash":"96113428317655762137b2af67df8694322020cbe445de963e7c8a462f91ca504f0fee","first_seen":"2026-07-18T17:14:55.577541Z","last_seen":"2026-07-18T17:19:30.012336Z","times_seen":2,"resource_available":true,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/856e5f8112b64eed.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.443Z","timestamp":1784394857443,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/856e5f8112b64eed.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2mbsVZGcfZZSW3%2FORN7rS8zf3dTru764ta%2BJevRTTh68QebqkHStdgpGNapsH2Pr3Y8QLI9uWfR2zw0v4wIojQ2pXjh7goeRXJOkpQi4BMKa45tSuM%2FU1I5KrfR%2BIrGJ\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"407e74e0f1275b6ebe63544cc6c0f2bb\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f32fefb56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 20713\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20713,"size_decoded":21519,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"e77c18be6bc9c3458fd95679b3256f70","sha1":"96078530acc96136747f79245cf4baa1cedcf15f","sha256":"011f43ed3812a0d4bb74da712ab13f37f5ed4cabfa87017ff352f1e69bf3066d","sha512":"73749bdd6d3a83c453fde8f65b88ebbfaccb3382decb7a8f3525dac44b6a0686cdcf63e0f3feaec9adbbd27732ef2043557f4f97a6bde6e7b8e8181bedb7254a","ssdeep":"384:M/Jjb8Ms7MTWdYCioypWZSJYTso2hZP+lDmaOPACGWlDFn85YMYsX:0xHobs4SJ+DAaDmaOPVs5dYK","tlshash":"c392f1b29bd896abeb876e27e01d41f4ca999146fe31c29914b9e03e100f5f1d81417d","first_seen":"2025-10-12T07:48:56.649133Z","last_seen":"2026-07-18T17:51:04.6361Z","times_seen":52,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/584de4183f51a2dd.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.455Z","timestamp":1784394857455,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/584de4183f51a2dd.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UaTXdFQIev%2FpojgRukkYRoGyruGwa0WM18LNPAmNQf8IsY5BfUsh6tHCcmIOGRF%2FwZTfDRAnkOvG3q1%2FEX5%2FV3zm4gn7L43MsXS2FoP%2BCowUVdWIuABFx8Q8KGUBJNFk\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"079d4e097daf9bb343f614015a3e5347\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f331f0a56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18762\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18762,"size_decoded":19570,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"9e1c77727835922ee9e6a536d2101423","sha1":"1f48885be11d26e1e3f7f59ccaa8e3a1eac0a42b","sha256":"23986db5adf93a07e9027ee63619ab0ded8b64778bbc3766ba3426ab25c81ca6","sha512":"1d30eecb07843f20e8eaed38f220d7940e158463c107616a1ad8a0eb64eef5155d53b7eea129bb85c13f701f713bc25fa47f3555edf8ecdbefa0826e1f23e687","ssdeep":"384:GxKOBzBWEY/LYfkWxU0mQvLAq7HHfDK9dh7i3Hd6/9G:8hsX/LLW9vvxTQiHdQG","tlshash":"dc82e00abf49c145cf44af11e85f6c67abd9c2624228b3833274cd568ade5e10d98bca","first_seen":"2025-10-12T07:48:56.717608Z","last_seen":"2026-07-18T17:51:04.632694Z","times_seen":52,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/21ed97f16d730384.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.609Z","timestamp":1784394857609,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/21ed97f16d730384.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x8KpaqOJ0OhmqVICq9SwElE34EzhqK%2B6Cyt02VM%2FGiiL2uKvLpMMvEDFxAwYBUXvV5V4WGNJbx4EZkvnw3K9ITn4h6W75qijwGzB87fAkP7QgOYyUWJn5vIMikhGgdLl\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f340f4b56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6757,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/407c2ecc70263c73.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.611Z","timestamp":1784394857611,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/407c2ecc70263c73.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P5%2FMxtpGOOAKFA7%2FooOxXuU5X0EDwyX9Vh0l6QgiILUpXYzOWdM4%2FwTEpDBQNsISg%2FKzc9vukkLr2nKUhjaEhwT9P7HXlJt9YlI0DAe4VbTVwQ2V7IkBhPqqq7Z02NVW\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f340f4e56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6761,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/662d0118ce68c7de.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.437Z","timestamp":1784394857437,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/662d0118ce68c7de.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8NfT%2BGxA1IhbrgkZTKuYz7bIEEzarKkZjQpNGrwFd%2BD30rTrpVc7HldFRrNaCVUq5kygHBPOE6AL01qFISkxiwTxhSORNO5hqFjN3749K2o2IKAaWHDZwMZJhb%2Bu8%2Bdl\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"888147a23345d1f2c62c09c27345d708\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f32fef556cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18686\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18686,"size_decoded":19492,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"1598d4e1397893afab65099adb8177cd","sha1":"06a9b9ea260d14a3996ac1173093c1041008232f","sha256":"bc95ea72facb19b3a2e791f7d453ad3f6ae26715093af849ea2e997f5568085c","sha512":"862f23761ecf4326be9ffe39a18fb5e1e84be9a44157d822b55b86af2c40adad481428fe2cad766cedfc390c4c57a40ae8898ada36c54fc95f596774264f404e","ssdeep":"384:0H5PdFpoFJYrnNZZbO8yd8cdVAxQ3qsB/cGnPv9FapRFG9f:SsGNTa802mq2cUVFPf","tlshash":"a782d019ca717f87f90acc755118724bd322b912b2d3cb16fbb1bf8914b81d51518c28","first_seen":"2025-10-12T07:48:56.587042Z","last_seen":"2026-07-18T17:51:04.621739Z","times_seen":52,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/9eaa9012ca803c5d.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.460Z","timestamp":1784394857460,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/9eaa9012ca803c5d.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MgiyH9VZq7f5izxe3iOSjtPvonmQ29BTPG%2Fmwlz%2FUQGtFtmCpckiJcYRAS6V8YIKGsenFtlt%2BjeBhP8S03jGBjW0yshnWohmGo%2B2Z4aIRfRg8%2FCaZmkghXEd9%2BzMImUj\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"34396c4a7f454141a11a7019e3cacf6c\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f331f1256cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 23065\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23065,"size_decoded":23875,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"e807f953f4d2f99b691d0432df9083b8","sha1":"d81228ed1a0954f84a077cb3e15c8927d0739ee5","sha256":"f2e40e082aa57cf53602d9ab943c4194e0dc7771f55cc89a3e74d21bb372c16a","sha512":"0faf8d4580dbe08422e0aaad3b4058e10b28e283e9ed954cb1163162cfce42985ee47fbf9be597850a4d96b5304dffc210bdf21a8ba78ca809044b1e302059a9","ssdeep":"384:mPUjURMwdcs7w1aFG6IYUK6oF6YmQZ8zFjmEopWZuxakmcwLLuunyKbpi3VSMs:mP4UuA7YaZUKJFXXERkWZuILuun3D","tlshash":"85a2e193f3595d49f0bc5e3d777a86b2d58616ea896c89f3117fc724433a3d2008611e","first_seen":"2025-10-12T07:48:56.595435Z","last_seen":"2026-07-18T17:51:04.635565Z","times_seen":52,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/228d8d39ad03e936.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.465Z","timestamp":1784394857465,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/228d8d39ad03e936.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F2FZIcRj6VHMzbhSbgd00AFNfOQql8bzPyVnUIdUoe1rVJ8iJtjNIqYDjiw5VUw4ixAElGWDyxYWD6GG6fT%2BdfjOuJO2qmQuoIWg1ulX%2FlQDcHaK3i22q4S2oAXWLn1K\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"aa1f79e7536d4c3171d2426d91bc951c\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f332f1656cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 24141\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24141,"size_decoded":24945,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"342238a10199f5584fe84850dd98b10a","sha1":"09a3641d178817003cc352974e4247683278ab0b","sha256":"e9e3e2b78902b7d98e95276a7a13ffad1cb72fd7f029b71a03a202c78651af42","sha512":"daedabab0980afcbdebf5a6639f8433dc5587a4814b7f15e2cd84562b08cd9162af1d85cf81e9e75461954920c78f934c81e326b0517b594a41642395e09e1ed","ssdeep":"384:lM9HVO2aqhb3cocBGa7VgNSxZKADqcoAvVaS6ujWR+LNyVaB7OZiblkmk+8VHMJU:l+Zt7a7VgkxBMWacjWYZFSiFk+R11NNe","tlshash":"29b2f172401811f9a29a7dea64ef9b541f335c83241f0869bab7e879103c2ca67cd1d2","first_seen":"2025-10-12T07:48:56.759175Z","last_seen":"2026-07-18T17:51:04.625608Z","times_seen":52,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/2751280353c2bda1.png","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.472Z","timestamp":1784394857472,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/2751280353c2bda1.png HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F6XLlDWPvbjWOWBcqc6JcFxANmbSBoUppC8c0isu%2BiijfCsD5QW3O5xvW0eiMlJg%2FfVjOveqGLf5%2Fm%2BPnaxLCn0K7bIZwBmwYrd3oj7L7xDxSMXyMLwpdBbGp47ZVQ4g\"}]}\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"7fd4547a3c9d59afaf332063de29e0d0\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f332f1c56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1834\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1834,"size_decoded":2640,"mime_type":"image/png","magic":"PNG image data, 112 x 53, 8-bit/color RGBA, non-interlaced","md5":"b0e3ac9ebab6af5f48091dfaff855a54","sha1":"096de8f22039486621f167862d3cdd2f7d6d6a6a","sha256":"fed91cc5540efbbafc70f90d761c9caf1855a43f9ac0abdf58b43020bf1fca76","sha512":"6383332e70343cc4f6be1510e793ff8416c9a1d2de0b6e255121026683a162cb12075e2e41f0074d0eac618390f884a5365716cd50c2a1842b0b2dfe2c7439dc","ssdeep":"","tlshash":"8731094ebb253d6f55fd6e3d47245434a43f98bf3454293ce87745085ea520f60075a3","first_seen":"2025-10-12T07:48:56.729773Z","last_seen":"2026-07-18T17:51:04.63383Z","times_seen":50,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/186becc321b159e8.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.596Z","timestamp":1784394857596,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/186becc321b159e8.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hwkOVcQJwkvggPCFBivdwAMw0u70SmndFi%2Bs3IyAdaeB6wSTIwwk1ZP7geo2FpvaZEhkujpCOThzddQgJZdoyXTj5XxR3xU7Sl%2BISW9ywUGl1%2FWtdwu7LAoxykpCsMrH\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f33ff3f56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6759,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/3f051fff1af4167e.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.618Z","timestamp":1784394857618,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/3f051fff1af4167e.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pOj9K%2BokKgBR3hEYfOiGt3512rWKf51Wt8CDrHfknfqjbbfpjHMe3AZvETd8YwcI8%2BbR2G6GtvWJbCxcro6bZckQGKaIVUbTOqXmNMLOIcNICW9FEeuHiwcXgJ%2FywH8U\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f341f5556cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6759,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-18T17:14:17.061Z","timestamp":1784394857061,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2B9H%2BNxeEfvlR9eUf%2BhL3YOfpHoAhdxjiq2New5%2BzwtEGLa%2FSolJf9l4LvBdd5dJvC%2FbAR%2BzbJnFrqZbGFSA9d2xQRBV2%2BeBHFpyXQ%2FfN3eHVpazjVmmvPVZumtjqHKE%2B\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/html; charset=utf-8\r\ncf-cache-status: DYNAMIC\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nvary: accept-encoding\r\npriority: u=0,i\r\nserver: cloudflare\r\ncontent-encoding: br\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-ray: a1d31f30cec656cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Twenty Twenty-Four","description":"Twenty Twenty-Four is the default WordPress theme for 2024.","website":"https://wordpress.org/themes/twentytwentyfour","common_platform_enumeration":"","icon":"WordPress.svg","categories":["WordPress themes"]}],"data":{"size":51515,"size_decoded":9590,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1431)","md5":"4dbb145e3e5f38562b7e70448fb7ac40","sha1":"3b4b0acc3fef336eb40e59acd56792c3092efe5f","sha256":"6fe2ec8bdb7b60847736ad3b5a5c0f9258f00002496647cb405c90280fc74341","sha512":"4578d0bee2cd6ee54c9cce799dca5d149a662de24984655afc17f04b93eee9fde449fc553f9e173acc95e16eb56b1fd60e00a861e2283b77da4404c3ee29a1cc","ssdeep":"384:X/uOO5/NVPMXy2GBPzobqSGy7QTbduR5i:X/uOO5/NuXy2GBDSGQQTbdGA","tlshash":"f233a71360f5502712a2d6e59920af19fe82d01bc91a8e55b36d839eefd2e418df372c","first_seen":"2026-07-18T17:14:55.584409Z","last_seen":"2026-07-18T17:14:55.584409Z","times_seen":1,"resource_available":true,"data":null}},"time_used":166,"timings":{"blocked":-1,"dns":5,"connect":20,"send":0,"wait":140,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/3af56b393c6c6553.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.440Z","timestamp":1784394857440,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/3af56b393c6c6553.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M66TaaLaeVi56NzOUwdjk263Vgj4Vl1H5TGl1WYNcA0rVmgpMzvJ%2BBLPxM5LEOqOTt5s%2B55G6WkLNMirKQ53f1gAPrXk8uBaYesia36WbMUlPL6oy3F92prXxNoZWJ0O\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"f210de80b19f1952c50a32222ab98305\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f32fef756cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19396\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19396,"size_decoded":20198,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"05576e9f1e9b78305874c7c6d7c6acf9","sha1":"b64623c3c7686107acf0df42b5553d2e7cfe46c1","sha256":"73c34250a6cb2e9bf17ce42b9b96f801a07dec40c17b2401451b386d52efe815","sha512":"dc2f953706f4f595378e5c9a05d7a35ee95756c9e0e39dbfa389521f0a763d1cba213a8100d8bce2fa2718c28f39379f9c40b4cc36e0b844b2c3a96b9377adce","ssdeep":"384:tMeguTTF8c1l8Ch9S80tgC6yRoiMWYnwlNRg5vE7Q8HMTrT:tMfsW6GCh50t5O0A5v9gMXT","tlshash":"eb92c08fe5124861f61d9de2c667b050231d9eb749d9729ef0bfcc4a013dce21771a45","first_seen":"2025-10-12T07:48:56.667107Z","last_seen":"2026-07-18T17:51:04.625125Z","times_seen":52,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/da2fdcad08484fe4.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.589Z","timestamp":1784394857589,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/da2fdcad08484fe4.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gOJHGub%2FKm4%2BYShj%2FeNIqBCVm98rb5E17t3wlibX5Eh6PXrUaWBYKlyzO0BywgeK0oQ7iqPKA6n%2ByQYON3meU9pgEy6zunp6K16SMYDC82jAyjqH%2F9gzHriIIe%2B%2BYvT8\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f33ef3856cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6767,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/ddccdaebfc8ad520.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.593Z","timestamp":1784394857593,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/ddccdaebfc8ad520.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OMrOT0bNTwxf97tmt8DO9OJ%2FK2QyOjoyv7a3JIA6kc8IdR%2F5BMRuYrEUvBajlGnwZu01KIC1F957J%2FBi%2FKedlzwwVooe5s5XMNBRNTsRW36D9TDCPZLgkI7hmLtayTZ%2B\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f33ef3b56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6763,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/25afbbefccd192c6.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.599Z","timestamp":1784394857599,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/25afbbefccd192c6.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O13YVEBL52D9SUL5JiUtPOVUwaXSGdSMi0ynjvOgJqlvbrLHARCshtXAq6oZuG%2F6NefKaOqSydrFnq49CR8aFwYKkMS1%2BkyR9nSrePvDvHmy7g5Qt%2BLRcOWLhlFtGC1t\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f33ff4156cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6759,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/81ae9246d45d092c.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.602Z","timestamp":1784394857602,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/81ae9246d45d092c.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cr4gCwH37M23OKgBd5SWs6eLWETLz1Drq59HEHup5Smole%2BIiXfxcQlbp6DiNa9JdbliWW1fhJPV48u4V1N4FoFRvnaw0jcuTCVrzg0iCahSqqVM4v3gjWw8QGq1N7pC\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f33ff4356cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6755,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/16c49875b81ed73a.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.449Z","timestamp":1784394857449,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/16c49875b81ed73a.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HJRZqnXF4BWPcwb5kcMO1wMPoS%2BeU43UqiNJLjm%2FcqUmYjtz9VaTs1pZ6dIZgiQEqndrzmuZgf3kD0btDPLc7HHQsOPN68MhOMVoa0HCPMyo58QRluVJq%2FgR8xK7IpFo\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"efef86a971c8b751701be779d62c73eb\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f330f0156cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17980\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17980,"size_decoded":18784,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"b97d085f5ff96cbe9974c0f0107a897d","sha1":"4e39de0c132dd5c10dde388be9eee4e7c29c63f5","sha256":"12c48c5369f818d2e15dd3ceed42c5424d3ab2ae6b71b22aaf3f8c596a54f4be","sha512":"95870b0cb22240ad1c6606ab33075c9123f7a45d803baee582ac2221150b3f6c0e3d905b7ac65d9ae84dfa9c02a4df8eaa385f40c9d0c5da4e0abc10b6bf9c0a","ssdeep":"384:UDOPgdLkWD5vxQCOi8szsbtzYThKC7zOxEEM0GhgBpFUoP:UDXllPH5UfQycoP","tlshash":"9d82c04336e377487e6c4e754abf0735a10ad23760623e43427ce99a2d854ec7d827ae","first_seen":"2025-10-12T07:48:56.64297Z","last_seen":"2026-07-18T17:51:04.615931Z","times_seen":52,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/f9adfac292df7564.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.450Z","timestamp":1784394857450,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/f9adfac292df7564.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BBsW06U1UsPBnwzaYijvdcAIGsNrofDJwDrbX%2FccmICRmXoUon3%2B%2FlfTkfCON8cXNhvr61hC89EqJODX3nVvA4FF%2FTgrl7LAM6xiNBgovR9obHvW8eIQVM9V9UE7jRzw\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"711a49496727efc364c969a1d1585a9f\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f330f0056cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19509\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19509,"size_decoded":20317,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"4a4a7b11403a57b9a44c6003e08bf9a4","sha1":"7213b138996ff205e92675936c5de0740bce835d","sha256":"937087e34c8fbc643c605a3aa19f4e737544ea0b2214f857c597dd3645d2d816","sha512":"62a541768c16c1f53aba733f6181962cbddf8588dbc490e8a54e74c3615190f48596df1994ca986e74ed9cef4c9add928e4c3029df9c328a5b9c3a2c88859740","ssdeep":"384:eQSkwV+SOSSnTvFygSmBAEu9Hbktb6/HqB+DMcLHTyMH9:BlwVSSSnp1ra7ktb6/1M4TyMd","tlshash":"4a92c0379b49999fe6162fbc5ea347218acf588d18bb4ba344bcf0a823501e9d41d42d","first_seen":"2025-10-12T07:48:56.736156Z","last_seen":"2026-07-18T17:51:04.632172Z","times_seen":52,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/f20c58b64bd44cf9.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.454Z","timestamp":1784394857454,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/f20c58b64bd44cf9.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dLbupcRHXbYIXpCtS%2BvulaWNZqkyHn5MUN7MQnXe39nqCE2CGTMYzLrg7xRb3W6QPfetNLV40sj9fsyO4Zo0tFWmbCDPPqf2WQ2Jm8cQAg4WFmtrt85rPQpIBUWC198J\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"fce13ca6526e6e0dfe541f6e95bc4377\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f331f0756cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 20377\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20377,"size_decoded":21177,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"2830de20d1f744bb3a33ad4c2ea9d463","sha1":"50382faa7afcedc7929fd60537906f37ea9a9e4b","sha256":"f08d7168907d149487548a058ce0b0f0ffb5029f3c65c5d470d69e99a56b93ed","sha512":"24be110f02b1cb61bf971b69cf16dd7e8d63b2d55f07c2b97f0d04f8ea1fb38fcf826c1e7578f3bbb01918b5175e65a1c7788b670f7efef510f237ee866b07dd","ssdeep":"384:CwBgx1ZDOsG7dIujRXn58MwUqAytdX2C1uAW8HiphK3Ua9UuDd3ku5OU:C6gDZDOsMt5NwBtliPKpdUSOU","tlshash":"b192d025f7e0e271def19fbeaa41713474a27f4e9f834f852136c46d24008cd156e629","first_seen":"2025-10-12T07:48:56.651906Z","last_seen":"2026-07-18T17:51:04.628587Z","times_seen":52,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/35b9900d36dd8386.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.462Z","timestamp":1784394857462,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/35b9900d36dd8386.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=T5k0zGZOx0Oud9nKCIkdsgr9AeLGDD34m7qG7QUK4csMhHSxEZpyBJDb1qAvGvYP3iHSccy2Le1pDjoJy8%2BL58CnwZliAf2I%2BkLdti%2BJAP8gvJklBGRpGQVGAyq71dyf\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"3d46b2a153e7fcbc36ea189de3689362\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f331f1456cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19273\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19273,"size_decoded":20077,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"e83e918323baaa0ec015a07220cfc8bc","sha1":"8598a4c6bc0203407f1075ae55df00ec2a71ab1a","sha256":"e0806f42619f031e872e4c6cb86aa6c0a50dbd5bc8f2eed49ed4e6ca93b430f9","sha512":"4eb83643fa9ba312dd4ade566f049bfa2f59b984a858cbe053b1e0f4036785e8ca28895f829ad73a10728f435e8a9b74817c33a63a1c38c4e7d120ea8a09c331","ssdeep":"384:l4cPgLBij8JGqhSd4qf7lyVWFZOqvATCTzg0NA/JpydL:rUsmXhSLDFZKCTzxNAhsL","tlshash":"ec82c0b0b3618e60d4ba5e768bfa079c3dc24b911f40a20fd918dc9014765e17b989eb","first_seen":"2025-10-12T07:48:56.626518Z","last_seen":"2026-07-18T17:51:04.617056Z","times_seen":52,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/36f7d388e755eaf9.png","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.468Z","timestamp":1784394857468,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/36f7d388e755eaf9.png HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LGIke%2BfODtr7afBwkdUilXiO7C4pPwrYU6Fs5ZirBf2IHkDb7X7pJg6l0Pvvkj4h2FivL2HOXe1hjnGjuJ2ehoj0jZsBmS%2FQtnTD3Te05IpaQGsIrzvyeod7dw3lQ3QI\"}]}\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"7e8d787195ea19d705523ab62982362c\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f332f1956cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1773\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1773,"size_decoded":2573,"mime_type":"image/png","magic":"PNG image data, 142 x 41, 8-bit/color RGBA, non-interlaced","md5":"38de1c961a07b8775a1f371394823f5d","sha1":"d5641b182fdc34a993832ccb5bbca86f07d84c7c","sha256":"6d2ac0ff0c7768d59ab47eee3383fb917c81279f5f5e6dfe2360e5c3b42e52b3","sha512":"487fec2f394e354b5e9a4860cdc5a7a58dcccb5d3b8cb5ba7b049be8a2ff082b9b1025984a9fc43bc7d9f4c078342b989b4296d2327cbc77db9f84cca1f1f847","ssdeep":"","tlshash":"98312bd297898137891f53c6be8fc396fd4cc42668af4d216e46bc26053281cc7246fd","first_seen":"2025-10-12T07:48:56.616835Z","last_seen":"2026-07-18T17:51:04.620775Z","times_seen":50,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/100f8fbbcdbcaf43.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.601Z","timestamp":1784394857601,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/100f8fbbcdbcaf43.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EU9B0rCjEWHZ7Desp9iwYe1eLvAV6A490ZQnZczYeGlgNyDUO6wAAYIctBQDKOC%2Fx7y0TcrUgXDGERGgDMR%2FUMBH3yovWlrpS2HWEwYUuHy8cPTQ%2BvNN594itcbOiDD5\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f33ff4256cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6759,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/cda0072b360feac5.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.627Z","timestamp":1784394857627,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/cda0072b360feac5.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BK0CB84gXn7AD1k1R9i6DKcjJEh3XY59prXArgIgBc7UOCdNB4UevW3ZUMV70v%2FcJVkTO6KUgZIqBYMeqz60DjH7l7LyvckBzVFTxDTO9bM3%2Fa3ObYca2JcCoQxgTvdK\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f342f5c56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6757,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.428Z","timestamp":1784394857428,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript\r\nexpires: Mon, 20 Jul 2026 17:14:17 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IW7nAsTY7EUTXeulqQUoPFfVp%2F1uEWBLTT9dvXXWRJoLjoF5eebtfBMauKwK7dz6hcH9WkVDkwhP9IA3JHoK2pZP037Xe19sTJ%2FcKPhPKP%2B%2FUQ8dKas2fY7F%2BguUy6f3\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\nserver: cloudflare\r\ncf-ray: a1d31f32eef256cb-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":1236,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-19T05:20:13.312769Z","times_seen":400431,"resource_available":true,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/ad9bdd46bb7256c6.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.453Z","timestamp":1784394857453,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/ad9bdd46bb7256c6.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Mp%2BbzXWZ1NSt0J099JJS5QTFPpjBHxmRs8LfM7lMlQEuAwPgjYOKqoQ%2B4FiD0NUpxgBQfy8McAC5QtF%2BURkOz5YivQsr2A0yNzCCJMPtRi0zmWTII82%2BFAdTI4a1r6Gl\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"6929a613565eec4fa1f263833e7f9513\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f330f0556cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 23881\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23881,"size_decoded":24687,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"393f4894c0e31329594f3d4134390af6","sha1":"4d9d3ccc06018b47bdc16c0ddba6a139aaeaeb3a","sha256":"c6a0f17c941a19e0dc8261d685e1c01bc102b5a56347e4bfa2c1d5cc557f1f33","sha512":"58bb1d0e74a322a2bf91cd7c78b3f6192f47309d1adafdb8af01189d32e778ea8cdf7cefaa000aa69239ec01d25b1f11d9aef754cdddf6b3e738dbb49c510813","ssdeep":"384:Odf2QSlgRl7J7ti0sVSabC9AUVrl3oO3LovrnTEuEUHkJNNUA45ju9tVaN:OJTSKYZSaYbVrl4O78sUX8wN","tlshash":"36b2f2db7f8907e3686a0d324391c855d7d0ae82f63b1e0543f1e87a49750ec1a94226","first_seen":"2025-10-12T07:48:56.740436Z","last_seen":"2026-07-18T17:51:04.635005Z","times_seen":52,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/9588e8b6d1aa9fbc.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.605Z","timestamp":1784394857605,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/9588e8b6d1aa9fbc.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Xq%2Ftv%2BU2NwN70EVU4dZqix2o6PYQVF2YKD00pUyYO6Gga4TWTgjtmH9t%2BeA9KrkP9iHQktzWiIQhSyX4ZDDc26dLnZHm56ZpOtBPhw79se18jQMfVf2zWWMrwoSdf2U1\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f340f4656cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6759,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/8bf2ec6cb47c43de.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.610Z","timestamp":1784394857610,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/8bf2ec6cb47c43de.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lD8jiOTnu1yeIMIZBRoAS2RlLf1MU8IJW8GUxZqWqqLZNk10KjCJvmRec1koeAKbwRx7H%2FvixceubYNxBo9cHzRsGmb6Go5UrXS4iWfN%2FNP5ywx%2B5y%2BJ4V43bRKcDraU\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f340f4c56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6761,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/2a8fd3275573a998.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.611Z","timestamp":1784394857611,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/2a8fd3275573a998.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gbFo04UGJ8x9abLHRTINTZC%2Bx6WX0pKTXnIWEuwCXI6QKZ5ozVSDtdNBcoW3bl5fBFh%2FRUm2Ram%2Bla4oPH%2BZX1q4SzZQsFEJUWq3e3oqlsUh2cI7fFT0mKRF7ldlETAS\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f340f4d56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6761,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/0569a0653d2e829d.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.632Z","timestamp":1784394857632,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/0569a0653d2e829d.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nyP7wmoQ%2FxD%2F1a1OWCsLLF2%2BW%2F2FgPh%2FCNDcd4WV0%2BVWi2UnKQsumAK0LGTdHEIndI77jg6o6VwKd%2FtUIqYA5Bfg23TMuFX%2F8JAOvxjl3KffYVWg%2BqXg18sbYi1NYXVC\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f342f6056cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6771,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/8aa4b98bcd42db05.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.634Z","timestamp":1784394857634,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/8aa4b98bcd42db05.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1XWESD%2Bs7fym7KPKv63PVPszsqgCqPAzIEZZExMSXnqya6eOEX4T5HQx%2FDv9aC%2FItZD90h%2BXG1mQehWaxurqT%2Bh%2FO7CC%2FKzifFJDCs%2FpQCWXAQiDkm4bA5KsXX%2BnNH6B\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f343f6156cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6771,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/53959f620ac47934.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.445Z","timestamp":1784394857445,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/53959f620ac47934.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UgtQT9RCVTxiav7MBqf%2F5vxrfGWquCI8UhaIsW1t6D6sn0hlL55Ayt3jdpe9Lal3SY3FycjBt%2FbCXpcAMEHyjGCenRbtQg%2F3uN6iQWGGMNUp%2Ba%2Fg7D%2BBSS0DJOEqEEvD\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"4251277eebce4731e2b64d9ced9cf1cc\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f330efe56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 16558\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16558,"size_decoded":17368,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"c1f6ce0e2b2e2e329d64d66d718933fb","sha1":"63c35c8ca4376f7b980b32b140a580752584ea5b","sha256":"d6f8f02c9efa915b3e3bfbba492ae7f9cdfcc34da0638c569fa77f6d59894992","sha512":"738db278d8e84dcbdfe08b87b01dcaa110356c28350a225a59122ed79507c045a0870e047ca838969d30b1233b4cccd4bc910eca73d530b75c788096f4a89018","ssdeep":"384:C5ccj51Kq83NJFZD/oF35jhvThvZQhccExW0bseT9Da8bj4j2l/qQe4:mccT83NJFZk3jl1vZ0VSvtxHl7","tlshash":"1072d1ebbfa5a015d5117c96ef472bc89b00f41f4c7483e538b4d886a867681bc1a4f3","first_seen":"2025-10-12T07:48:56.681199Z","last_seen":"2026-07-18T17:51:04.619756Z","times_seen":52,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/e8ce17ac518fc8ed.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.607Z","timestamp":1784394857607,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/e8ce17ac518fc8ed.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UbyqWSsX6r4npiPfziyfPYUNL4z0pZ8sJIeXyPRNzaSA9kFJz553mBu3Rxz02zNg3jEkZ1hl6Asn7TSnOrbUw%2BxSTg4VXjSDt9sP1NjNI%2FF%2FGtycNIS4KwkYewAGojam\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f340f4856cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6759,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/28c3ac41a2e78394.png","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.474Z","timestamp":1784394857474,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/28c3ac41a2e78394.png HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OFohhqSpqiEOXBrWhqT5jWxx8bUqdpEduLR5hq7hRr%2FvMOJGQmcwlW1yXtNl89DYQYNSZv7rrL1TyPT8D0GDPP8yCLvmQNohLkg8hXKZ6yz%2FKCZDA6Iv8NWUYvzLxHRz\"}]}\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"b743a4fc3f79d3d9726e8c97796da638\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f333f1e56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2070\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2070,"size_decoded":2870,"mime_type":"image/png","magic":"PNG image data, 200 x 29, 8-bit/color RGBA, non-interlaced","md5":"d2ec76eb63497a3be6c84d76342f7c8e","sha1":"22dec907b7dabe554c2cfb824a3fbfb06412e33c","sha256":"8a0a1981ce492013306885e7243bf162d403736313dc55e2df283cd00007be76","sha512":"a69a9a1ca455f541cf6a1085866341c0979a28b4d26cd5c7c5591ad9845ee2c03adcc83aec086a48a7e39d35bdfb86b0ab98fe7856dae9698dd09a0a85597f8f","ssdeep":"","tlshash":"ce41f8da2a10acf53c69c6399d54baf19512562fd58fdceeff1531380b09106cd74822","first_seen":"2025-10-12T07:48:56.63266Z","last_seen":"2026-07-18T17:51:04.617592Z","times_seen":50,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/0655f23a6940bef7.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.590Z","timestamp":1784394857590,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/0655f23a6940bef7.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xqqEmP9vzzvA%2B2It%2BS9XG65jlBYDjVQcgp3u%2FM2%2FxfbVhFwr6smOf1yi3HnBloKRs6F9W3ptizyYC69F0PaQdvQww9gX8R%2F2xZTATaTv%2F%2BbT7jrG6mCco6MYKgB6pvh3\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f33ef3956cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6767,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/735ee47d4a4baa44.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.594Z","timestamp":1784394857594,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/735ee47d4a4baa44.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EfBdThwjlnF2sk6pFN0xOsMt3xVqzB%2BVjtHAcMAzUAsa9tJ9JUCvod8Dx3uWKzMmD4lIyWRGbAU1oQo2%2BF5byGgSUVB9OQJC%2BSIoWtRvrCPIJXECTYkCSfdfFO8l6ZB1\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f33ff3d56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6759,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/themes/twentytwentyfour/style.css","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.420Z","timestamp":1784394857420,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/themes/twentytwentyfour/style.css HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=alEJPww2aeGSUsvpar2%2FOsipuf4UGp3%2Bl7M9CMAW1E2mZ%2B1h6mKTNlBLpvpMKPI82NdoXujAYX6Z3QAiz2QIg3GGsHT6zyo46wj%2B%2FH4MM%2Bmp%2FwJKwHHA447H6YH2KWcc\"}]}\r\ncontent-type: text/css; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"967e54a7f9ef28110570d2da7d161acb\"\r\ncontent-encoding: br\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f32deef56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30796,"size_decoded":7856,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (29819)","md5":"f79d916e00b2ec07e3d7d8838212a850","sha1":"cc44a02908e3e315899e8fd341e1085f5ab5996d","sha256":"14b4d5e7436f748e308ae4dc3687594f572c0758be1aca5ab26fb9fe44cbef20","sha512":"4ebd1005219d305d205a52782ed66fb4efeeb0927926d66cc96d926a1fd48bdf492c8d371354b5d918022ebc3720d9fabada0a3f27081aa588f1c1193300e27b","ssdeep":"384:WBHCI2qeMJwiqcF3ScVudwEdbXfPDWGDiDg0Q:WdJbScVudXdP7","tlshash":"74d2b47b9514324cf123cd3967c897ac4138d131d5521bfcea47a92687c7ba606f3aca","first_seen":"2026-07-18T17:14:55.604273Z","last_seen":"2026-07-18T17:19:30.02368Z","times_seen":2,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/8fc0377df7292920.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.463Z","timestamp":1784394857463,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/8fc0377df7292920.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7Ps%2BBvGNGjz0ZIWps2dz7WpN9k2LNBow1J8MgnmQZs8wViGoGLz1R0J2yJW5NsPgSg817mUZAU%2BLSshb3ylWWLWxdxddTO0EYpOsoz9WZ1eD37zn4PCpZ17B57swWByT\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"0fadb21f0bbd665cb41d069f4c4eca68\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f331f1556cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 21767\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21767,"size_decoded":22569,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"7772a6bd94a7cb81bfddfaba0e1c9d55","sha1":"d9cafc4f80e1e7ae24cd149e2200aa9ec937f661","sha256":"424f0a2a42f5c954db2dd8e7e550b4f13f134183a5b0edb0442a722c04ddc5c2","sha512":"129fad282e84dab4f88538510bec2bf4817247a8728c2dade6ed35a6fb6c242bf6e555491fa8d056be04d34fca17cbd5b453468019a0471f25939b3907290755","ssdeep":"384:Dgvm6O6Wljl9vksp7yQyrKfPH1RP8nj5hzrq1uC1IU3klYOLYjwSQd:Dgvm6alxkshNG21RmfrWuC1IUskwSu","tlshash":"dca2d094ce5805bd70768c3b2d3982357c3aa96386de9353a471dc0f8265f89e9824bf","first_seen":"2025-10-12T07:48:56.603556Z","last_seen":"2026-07-18T17:51:04.627066Z","times_seen":52,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/e7224cebfcf5ec8d.png","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.473Z","timestamp":1784394857473,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/e7224cebfcf5ec8d.png HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gXH%2BUpH%2FcKfNG%2FhpfY1sFV1jl4eGPFm3kwTO1IDHHFDoXkZukjR6WCPKmzw90BUQyZ6%2BCQbx8MGgeGse%2BOtsed%2FLedsFI%2BeEEneEvCybE65ocIGLu2HbcjcQ1vh1Zcix\"}]}\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"bd96338986af60087b7ffe9a23fdba33\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f332f1d56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1132\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1132,"size_decoded":1942,"mime_type":"image/png","magic":"PNG image data, 48 x 47, 8-bit/color RGBA, non-interlaced","md5":"04b20105330893345b4d075d6108e127","sha1":"28369b84a763ad746bec2df4ea734deab2e8d72b","sha256":"bc3f763eb8bcea422bd126fa0c84f617f2de86d3f65eaf872d8b36c6b95dd11c","sha512":"df1d896b5e8b4576ed270f78ead380a44f0faa0c2f70cc1b5dbbbb8996d1206fa9d6f3a840dd45f8e85b07b62ef4d39ea2c88843048e5de6315c5b095687483a","ssdeep":"","tlshash":"ce21bdf306ce1b5618bb1424a1ca8c214c5c7baec6d7d15e7170f155317d440864bde7","first_seen":"2025-10-12T07:48:56.672025Z","last_seen":"2026-07-18T17:51:04.62306Z","times_seen":42,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/4fa6268fbc2f55f2.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.612Z","timestamp":1784394857612,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/4fa6268fbc2f55f2.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WoGlK9BW5Goh1%2Broixi6Ovv0fkn9141oUo31e3LEebLBWVtqbVlzTc5f9ZGHB8xKse80kCDZmQ%2F0JNvjUU%2FfRXLZRTA9e%2FR7YeO96lflekG6jCs81lQtbcMSkOi6JYQg\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f340f4f56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6761,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/06d0ded4f3ba89e6.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.615Z","timestamp":1784394857615,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/06d0ded4f3ba89e6.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O1qereI%2F3%2Bkg6rga0rzwb8c3A0R63S9xyhB4bVCPI2pe1C%2BQ1fPiBDn%2Fw%2B4yIscFA2ZOdbxS%2BspODY7hwJOpYG0kIyrfqgrGsX7zO%2BNDTQaUMKBDnEW0wZEHsvlTe3QI\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f341f5256cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6767,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/93eb2ea1a495246b.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.621Z","timestamp":1784394857621,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/93eb2ea1a495246b.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FubKHlpjwlB9XT27Q0aaFgEwyCF9jXM9lF%2FQ4%2Fs10WHgccyNVFw%2BfDKLa6CRP26b3JB8DZe1m0%2B%2F7s2EIuzcilpeKatbR7X%2Fx402fCmrwhYyYb7Zjl83KZVNJFJMRoWF\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f341f5756cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6767,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/1481283e87d02118.png","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.471Z","timestamp":1784394857471,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/1481283e87d02118.png HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Y628sEvUVvaThZlHbI6hxgT1WGBY2SyIiEbJnYGXHSFfRiB%2Ffq0pY4gJ2e7rGTajGYEiYTCF3DmpVFXbpBldVWGkqRnzyzdWGCdufA7hSBNY7hJ9hEVCWeLBHxywYc2e\"}]}\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"b743a4fc3f79d3d9726e8c97796da638\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f332f1b56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 2070\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2070,"size_decoded":2868,"mime_type":"image/png","magic":"PNG image data, 200 x 29, 8-bit/color RGBA, non-interlaced","md5":"d2ec76eb63497a3be6c84d76342f7c8e","sha1":"22dec907b7dabe554c2cfb824a3fbfb06412e33c","sha256":"8a0a1981ce492013306885e7243bf162d403736313dc55e2df283cd00007be76","sha512":"a69a9a1ca455f541cf6a1085866341c0979a28b4d26cd5c7c5591ad9845ee2c03adcc83aec086a48a7e39d35bdfb86b0ab98fe7856dae9698dd09a0a85597f8f","ssdeep":"","tlshash":"ce41f8da2a10acf53c69c6399d54baf19512562fd58fdceeff1531380b09106cd74822","first_seen":"2025-10-12T07:48:56.63266Z","last_seen":"2026-07-18T17:51:04.617592Z","times_seen":50,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/1f7e04f363eac6b2.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.606Z","timestamp":1784394857606,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/1f7e04f363eac6b2.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iqzQ6Mk%2FPaCGiYwtKSpJSrApA8Kmzp9SAFXZVyP74MljotvaNfAwXgH%2F%2F8EW%2Fi21zVNTomGFcDLEcnwpP%2FLPy4wV4EO9EQ6bC8wNLSdOx6U4fpq0v0BoPUcwgt4zRmmX\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f340f4756cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6763,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/87d1484b8c6a92a9.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.451Z","timestamp":1784394857451,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/87d1484b8c6a92a9.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Nz0XXqm15aioLIAffYIKJtNdUuTuGZpreDpSOMGFIh3PX4oj7AMWr84q8DJ%2FP%2F21Uqzvle7cGz50XYY0vlRLHchtmb3bdwvhg%2FfUtWw7ZJhFfUOs8Tml1b8RkED9qKnT\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"4365a85c9e5a9f97cbbeb8eb355bc039\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f330f0356cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18424\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18424,"size_decoded":19228,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"5394a596c9b225fd736a72ddc4d952b2","sha1":"bb1df2cbc2496db5355e2c4d47094c63c08d7d48","sha256":"455f65415ce4fbd971e18bb0f823477d7409a289b726ba7c44b2dc196fc1b4b3","sha512":"1b4e1df9174216c8adf8ec4e3a4f7860aca88d7da472f03b3806a6e7bbbc4e99aaa62190d1540d7aff4cd36ead8eb3a2c35d2ad5082268ad922c1cc42d01b115","ssdeep":"384:jYsiuKVm3x/FjNbZjGjQdVPFvwP2VQ2htoBrMJTCsqR520:jYiKVm3FFj7GWF4ihghMJT4n","tlshash":"cf82cfa0da157c56fe396d7802356c0783038454ad261ac121bffaf446252ff95ef2d9","first_seen":"2025-10-12T07:48:56.623297Z","last_seen":"2026-07-18T17:51:04.626578Z","times_seen":52,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/6f93fa9c5f500ddc.png","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.476Z","timestamp":1784394857476,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/6f93fa9c5f500ddc.png HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nacSElRFYrJl54FkkR%2BnQgCOelnYIEM%2BhIhyThDPbjToE8pgkXh3Tzh8dLC1fjefyiJVBjKaz2pwOY%2Bnpw1ZM6%2ByqE48tyYWFjIvnaWscC8MB3gPJOXYP8hx%2BwifoDsV\"}]}\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"bd96338986af60087b7ffe9a23fdba33\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f333f2156cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1132\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1132,"size_decoded":1938,"mime_type":"image/png","magic":"PNG image data, 48 x 47, 8-bit/color RGBA, non-interlaced","md5":"04b20105330893345b4d075d6108e127","sha1":"28369b84a763ad746bec2df4ea734deab2e8d72b","sha256":"bc3f763eb8bcea422bd126fa0c84f617f2de86d3f65eaf872d8b36c6b95dd11c","sha512":"df1d896b5e8b4576ed270f78ead380a44f0faa0c2f70cc1b5dbbbb8996d1206fa9d6f3a840dd45f8e85b07b62ef4d39ea2c88843048e5de6315c5b095687483a","ssdeep":"","tlshash":"ce21bdf306ce1b5618bb1424a1ca8c214c5c7baec6d7d15e7170f155317d440864bde7","first_seen":"2025-10-12T07:48:56.672025Z","last_seen":"2026-07-18T17:51:04.62306Z","times_seen":42,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/197875477f869f46.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.608Z","timestamp":1784394857608,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/197875477f869f46.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hyzQkfZ8yJ0osWPD4Cc8gWGNqD8a9foRhGT%2BBTuPHk1fazQUHCTratSYcNlx1BkFA9JjeXgZ%2BQLCdsIV%2BHFiuVlY8eKqE7X53mDSt4lXnAohDCCTdkwJm9WdDt1oFbRC\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f340f4956cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6759,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/b1429745b09ae58a.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.613Z","timestamp":1784394857613,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/b1429745b09ae58a.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=j%2BRFB9FCnNDwhVLzwaPriXdTAPD3gdjNTOvGCunhaiV4BD8nH9uP4GqBOWxZULqmd6%2FCTvQVdeP3n7VhiBbR2vIMPM2R0%2FQ%2BPBha5dqsobVQAwybwr7BK6QnFX8VrArq\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f340f5056cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6761,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/b42ae29e835da396.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.617Z","timestamp":1784394857617,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/b42ae29e835da396.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OVys2bT%2FwN%2FugSNVh%2BEaalyFdSY3dN02gqE6rGPDugoiAIV3Fj%2FuGcH3mFHyczV6jlwjGsSGOtGgBPjxTvWHxId7ZUmroCeDBBIhTZ7dpu6JbJo3Tp%2BZYmRl%2BDSHN2US\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f341f5456cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6765,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/dab9d1e006fe309f.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.620Z","timestamp":1784394857620,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/dab9d1e006fe309f.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EWxa8k5IFdvhywLaqIzHGVmzI5axH%2FYr4TAilUQWw6sUp8JtvVSiDc33T7A4Geu6zqRjlBU5C7HyR%2F4mWob%2FwfreUAvj8VhZ9pEdY51bXDPpLDB2GrbYnOB1yhTNWFVk\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f341f5656cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6759,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/favicon/favicon-512x512.png","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.757Z","timestamp":1784394857757,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /favicon/favicon-512x512.png HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=v9vXiojQXCJ6tp0BkNmO%2B15lgdYoB5wZBu%2FAjtUHeBmrggS%2F%2FeWrFgl47X%2FeGenCxx6qiuVJyneY6%2FSyyzE3ea1gTyOCNvyLYL%2BehW8f8PfzR06xPuCWlLl%2FDf8vjjdT\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"11b536578c2993b1f675b7ca691ba223\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\npriority: u=6,i=?0\r\nserver: cloudflare\r\ncf-cache-status: MISS\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-ray: a1d31f34ff7456cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 253540\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":253540,"size_decoded":254350,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGB, non-interlaced","md5":"808be4255135a675073bb429c9dacd9d","sha1":"1991e06e287aacd7f5479dfcb378e444382ea6fc","sha256":"583c8a9592759147b57b071aaa3ab9f98d6bc12be68c8faaec30efe314b4c28d","sha512":"906644d75dc24ccb9623b9472c29cde4d68ca113411a13938b647247a076af385264990f907d220c3e38a00d4c0876388985bbd8978ea343ee21e918a00dfed0","ssdeep":"6144:a/MvOe3S0a8dkckpbHpk0hDcePpCKpD6fBKmE5ADFw:m9eCDWIFwSpsBKkZw","tlshash":"9f4423bf075f3d84c5b9b459150b7735f8a4b3346aa014a162abc007749dafbca8b27c","first_seen":"2026-07-18T17:14:55.617182Z","last_seen":"2026-07-18T17:19:30.019553Z","times_seen":2,"resource_available":false,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":87,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/fe2dbc4ef00e92a6.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.441Z","timestamp":1784394857441,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/fe2dbc4ef00e92a6.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2fnI4gjA3%2FODMwV6r94y%2BhsQYUXqz%2BJI2NcNZJohmcwr76NnvhOYHHoq6gwKPlR1AcX30Lx4cpQVdU%2Fklqtu4HZNjWLceB2fZ6%2Fi78QW3SRnOB3dYdlsUwwoorOoJR1D\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"f983595d6c3ad55cc64f7747ecd21f0c\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f32fefa56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 20677\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20677,"size_decoded":21485,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"b7ca976f7005f75e99b8864e76de6a99","sha1":"086103a1798abf487b80ea569d08126b610fe80a","sha256":"6ff52ff1573f92eca5873d04f10dda45a32c90d2fc38a1416eaba66711a16ce1","sha512":"236a47025de8ca904a6b70e1f5294f7322a25e0298e798cc7c58e293e83e774bf43b7427780edf4dd80d5d40aa3d5eb22be6513f683312a4199c145d220924b3","ssdeep":"384:H5svauSJL9pb8feVzwU2NSXFfQe3FZixXlyTneEufxzQz8QZFsJ:H5TpwW5h20FIeVwTweXJUIKFo","tlshash":"9892c0648d7f8111e59e0c3366b287ac2e197d478235abf7d038c9acf7d25cb166028a","first_seen":"2025-10-12T07:48:56.688486Z","last_seen":"2026-07-18T17:51:04.6344Z","times_seen":52,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/39ad8680cbfd6165.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.458Z","timestamp":1784394857458,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/39ad8680cbfd6165.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HXqw0LTgYmNgURcmqUplyNF%2FmxyDizCly%2BbmJFbCpbEShd%2Fj0d6qVGtuNKuKD0le7zGpbO54zv4N4%2BVFBkj9jK5xlWxnABVUJRZxGGjs0fDNrcKecZBB02tNR31ZgjLM\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"0184b3be48f5c12035574e2cf8ec9502\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f331f1156cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19687\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19687,"size_decoded":20493,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"73e56b1de9d50f0450e0c75f4e1e3f51","sha1":"5a55be1b425c66c4ddbceb7ee00052ce0d6f3a68","sha256":"0c5f848c16994d0f9d9e9bfb1d5f4fd65fb0e038e0d23c05c5615e1dbe9f63bc","sha512":"b76402769919bbef918939dea02e1c5ea86755a6913b670253cc35d514fbeb96a4595707e81a7e9c004355bcf43ec61c4cec22e0557757301dc514a005f273ea","ssdeep":"384:LViOJ2cd+l5/asZAHPAbllrGbiCRtVe87b4v4qXhXKFG6c6OA+3xI2jaPXDrWLS:ZiOJ6ZAK8NRtR7EhXKQ61OAOkaLS","tlshash":"2f92c0e6a6d08850eccf4dba6ca82a8e1506c72a5bd94d374773cb7035374e216cb7e0","first_seen":"2025-10-12T07:48:56.645899Z","last_seen":"2026-07-18T17:51:04.623609Z","times_seen":52,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/7d9ade69f00761e6.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.466Z","timestamp":1784394857466,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/7d9ade69f00761e6.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4rwU53FZdN%2BfljNUp4QveuXf4mHuVh5yz4f1HVgVP%2FtuCxR9Rb%2FCbyi%2B20N5Vju%2BrVMpnUvY5xFAsjFGtV9wUf%2FnfUCEgMAVkhm8w4JeBauTW%2FvL%2BjnsfG93mDOk%2BkZR\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"84333886e92e20ebf264d754aa89c53c\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f332f1756cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 31410\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31410,"size_decoded":32226,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], progressive, precision 8, 266x354, components 3","md5":"d48fcc099c011ae9b29934b9a8e077c8","sha1":"3829068da0867c59db1ad0edb30a86f6ab153f7a","sha256":"808f411d7747e8f6bc7d0d50d0a75907d4fe273fff7a6caf69056988aaa85905","sha512":"b9d63a5f4a85a1d47b576a073261b5265df14740d2c34fe8cd8b597928b7606d3f65404421d86b9936db3d199394193d4fefd884a6bd9be35e840d5e04399d31","ssdeep":"768:0GPtReVzR24S5/egdNffgl/AvZDEacR9LLeTAC+P+69kg:0oilRJCrdNffI/AhEacbv39n","tlshash":"28e2f1809fdbc60ce5601e3002c2a8ba9d6964d50e74d91c53ffc92506bbbc4bd67adc","first_seen":"2025-10-12T07:48:56.713126Z","last_seen":"2026-07-18T17:51:04.627543Z","times_seen":52,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/84d75d2cf29f8952.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.587Z","timestamp":1784394857587,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/84d75d2cf29f8952.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EcPfxoH8xts6lp%2F%2BSJw58whrzeUoiHkWGXcYiXf%2BfWUMgD%2FwTpemkVZS1%2FwggT6lEVexJaUxzUagU%2BAs9Gf%2BhRIT36txOENby22HrGhbIZ1j29DP9vzKhir9geX4fA%2B5\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f33ef3756cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6769,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/81a3f5420639b916.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.598Z","timestamp":1784394857598,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/81a3f5420639b916.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=azZ3JRyqx5Z7eCxBDWuVAVzqDWEdWDZ59O28JX3bzMvJStacPBFRjnlrEs8HA%2F%2F7hI92AMDariRwRMMNJlrrxglDHzcxHz%2F00ksqJtdYPuuFyGTsBevMGAP4kCQpvrCO\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f33ff4056cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6759,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/c571b5dd77bc8c30.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.616Z","timestamp":1784394857616,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/c571b5dd77bc8c30.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xqBgHj13xXrkBA8U8ocjo7OQ%2F1z5SnRO3kmfdDe9Z6jIhITsJoml8NyzGD12Q01JH2HPJwlPxSZke%2Bq%2B%2F7zUs1VZmTj7B6kvaCrhd0%2BQiNX13%2Fy%2B7Q0Ul0sgPilAf%2FSL\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f341f5356cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6710,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/69a7d4899c3837f4.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.444Z","timestamp":1784394857444,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/69a7d4899c3837f4.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tO%2BI4Nwf3A86CHhcJgXBAeuhKGqvpVuvoDcEwzlXhwMryalpxTgOD66M4kVg1xzzDjdY9v%2FtyOVMyqVFp68wvBvtHyhwN4I7SplhgISTcj6bOmE%2FcoxLROrwEXD%2BHlav\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"50326008a5df9a4c43a6be8cfb9be2b5\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f330efd56cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 19260\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19260,"size_decoded":20066,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"82da36d1ce860447b0c64e1f74db130d","sha1":"a798edb734fd4af73aee64cf8e4d5c24f2347507","sha256":"076e5be93589f4f87987aab6b4b1330779a5ee8eb2d446a34957f4fce33455e6","sha512":"cb0f15b4a741fe5c51a83ebba57853fc65ad67d8eb2a0a55c63899252e7b0d35e2534e59f6c22bda8e0b52d6cfde7adf372d08a3425a7e852ada1d957ccc5433","ssdeep":"384:RY1RLujg6+ioob66qhFravZHTJl3n9MmtXa+E4ioZzcK:uzLgg6jLqHravZTv39MxE9ZAK","tlshash":"c482d0b210c07f27f35c9ebeb7a8c87787e347295786b3876239de9292850c78848345","first_seen":"2025-10-12T07:48:56.620089Z","last_seen":"2026-07-18T17:51:04.626094Z","times_seen":52,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/7be9290858652455.webp","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.434Z","timestamp":1784394857434,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/7be9290858652455.webp HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PN8kFj2zfaUESuIA%2F9X4GyWPhHZozjxSq9Zkdm3NnV73oW1THK0Zu2TinZz6QT8kCUrfz0AAe0jqdtMEnZxtmeghKmSBrZYGiG3enK8J%2FvT6EmAK%2BjYa2oXd%2BiI1U7tE\"}]}\r\ncontent-type: image/webp\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"2ec3f45305c3ecc356533716d616266e\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f32fef356cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 28656\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28656,"size_decoded":29462,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"be55db140f148ae5a084894ed8837302","sha1":"60b99d50435fed0f18e4e4e7db48424de912c0ab","sha256":"dae3573b384421ae8b1675e570fd0fa2df20e151c6cae6b32ae5264d22704eb1","sha512":"0473016f8c3f9627d0e64dd1f5a601ada8871b8492b9c431cfdf00045e21efff9d3b80ccf0913ae115462fa151d4f7800c5219e8bbf4b2475510d9e440914124","ssdeep":"384:FLMomIwhLYPvW2WccWJD5FI61rx8+xtR7ty1OLptcWUhIJ+A4K0+K:FLMo20GocWfI61rx/7/vdUhvLK0+K","tlshash":"c9d239a1c32908d5f243203275550258a337edd7bd38eb866702dcad97513aeaf399ec","first_seen":"2026-07-04T10:30:55.332064Z","last_seen":"2026-07-18T17:51:04.621254Z","times_seen":13,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/a0b256d8b160d9f0.jpg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.439Z","timestamp":1784394857439,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/a0b256d8b160d9f0.jpg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=75bUr112SDUz85fPnpDE9b5WgRj6PWNkib5OD%2Fn8tgViX4DpsqSCK6mzwP4aao5hQIwDB9xRKjZmWQ3nOdukLXbDm3YfZZKlRAIrc0EO3JPqsJUdNtqsHdErMrIbEg9q\"}]}\r\ncontent-type: image/jpeg\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\netag: \"5803ce9dd8b5d351d4dc34e3b981a88d\"\r\nreferrer-policy: strict-origin-when-cross-origin\r\npriority: u=5,i\r\nserver: cloudflare\r\nserver-timing: cfExtPri\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f32fef656cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 18867\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18867,"size_decoded":19667,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 266x354, components 3","md5":"a1f257fd5852a3367435d988e537da48","sha1":"f418358044d2c53cbbb99848d3db32b1eb8f62cc","sha256":"a5cbd71502bb8465b631e6316ed8ed331efc325855b98b0cefd0896e3e2e237b","sha512":"b662716c76116fbf73b06879a650a325c7ad5ae167925c6bb40e10c1c8680e7a87bde646a69cc382b5e5d5212b822cdff2738b94e5aebbe8b597730ce0135c68","ssdeep":"384:NqtOxX6jU2O/2ODee0/QIo1Wcn8BpDfV5rHRg84ZA1l3:UOxX63ODeQMc8BpDfrHN4ab3","tlshash":"1682d021939c5855f52e1d3cd28373d8a1c63a8f4e477be8a1b2f2b2792d1cd94ac901","first_seen":"2025-10-12T07:48:56.613703Z","last_seen":"2026-07-18T17:51:04.624637Z","times_seen":52,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetee.com/wp-content/uploads/2026/03/515912e49744ea52.svg","fqdn":"rainbetee.com","domain":"rainbetee.com","tld":"com"},"ip":{"addr":"172.67.192.46","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://rainbetee.com/","date":"2026-07-18T17:14:17.623Z","timestamp":1784394857623,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetee.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 00:03:26 GMT","end":"Thu, 24 Sep 2026 00:03:25 GMT"},"fingerprint":{"sha1":"42:52:C6:89:80:87:5C:3C:5F:3F:93:02:B4:A2:41:23:59:ED:04:D5","sha256":"1D:BE:6B:86:89:68:C2:88:6B:62:D6:62:9F:EC:A6:7C:A0:33:DD:65:68:1F:10:B8:D0:C0:39:DE:40:1A:B1:E1"}}},"request":{"raw":"GET /wp-content/uploads/2026/03/515912e49744ea52.svg HTTP/1.1\r\nHost: rainbetee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbetee.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vvAsLlv17d2B2cfBKNcLhg0iYLOzd13epQtt9Zax7oDhJW3XZph8zwfNebkpb78FD%2BYp3Z%2B0j1Qizsz2g9PQ58PS6fJQmBYtSmhmo5cp8wgA8N141iKTw2tgT3MaYiF8\"}]}\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=14400, must-revalidate\r\nreferrer-policy: strict-origin-when-cross-origin\r\netag: W/\"23306222a45248858ca480e12d8b6939\"\r\ncontent-encoding: br\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nvary: accept-encoding\r\ndate: Sat, 18 Jul 2026 17:14:17 GMT\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a1d31f341f5856cb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16262,"size_decoded":6698,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"670470d454337c8c6eaee623167dabc3","sha1":"68a63e5a24ea782bd7b2ac0408055a09cb2ea990","sha256":"3106024d95e4eb371f4a2f8f0640c6c55755683d875a9a5d284c94976a736e84","sha512":"157abe4b93927f64b71f92cf5e21262ae3652da036bd250e25afaa10d6aeac8803a5bb30a6bb118ede022f08671203f5f41f87cd7b72641ce4ee80a7b6053ee1","ssdeep":"384:f1cNDhR1R7FDQiW/BBJLq/mBsPDuqV6updauX+:Ncr97FDQZByEsPC4pHX+","tlshash":"4c72c6ea533802dc54c79a6fff2564f9130fa4f7b95b81919d9e8bb89087a48f613d00","first_seen":"2025-10-12T07:48:56.600079Z","last_seen":"2026-07-18T17:51:04.618133Z","times_seen":50,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"rainbetee.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}