{"report_id":"884fd21c-825f-48bf-91a5-376b2c057519","version":0,"status":"done","tags":[],"date":"2026-07-28T16:45:32Z","url":{"schema":"http","addr":"rainbets.vip","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":0,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"rainbets.vip/","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"title":"Rainbet - Official Crypto Casino \u0026 Sportsbook","dom":{"size":213356,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (9139)","md5":"3ffca8383b9a8d241bf86627337a6e41","sha1":"5b0c010fdbdc207ca9483f18d17a1e7dce830a1e","sha256":"d9ebb461fd1876445eea20c0ff0049c9a0242f76bdb1c64dc7b657daadfc073c","sha512":"564a324181b92d6b33e4bd5a6c54e64926eb441c1a5d4b9fb081ad01911ed931d97d578f36a9b993be373dfe46126476737961e54f7ea49b50844fd031965a4e","ssdeep":"3072:D/pPPRKmevZ+OsTH2V3oxwSzZXZOl+sR41BR/zpG4CAME1AUGW:jrKmeoRAi","tlshash":"6024f86643a47079321ba3ac5d49b71e763dd203de0245e8b0efc154abc6fa28977e0d","dom_hash":"domhash307a0ab23047fccf48b53636996c0eed","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rainbets.vip","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":0,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-01T16:45:32Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-07-26T22:19:52.505461Z","alert_count":0,"request_count":5,"received_data":285109,"sent_data":2792,"comment":"","tags":null,"fingerprints":null},{"fqdn":"images.dmca.com","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2000-05-18","domain_rank":84234,"first_seen":"2012-06-18T23:24:47Z","last_seen":"2026-07-24T00:47:14.347916Z","alert_count":0,"request_count":2,"received_data":6945,"sent_data":1071,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]},{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}]},{"fqdn":"rainbets.vip","ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"domain_registered":"2026-06-24","domain_rank":0,"first_seen":"2026-07-28T16:35:51.982824Z","last_seen":"2026-07-28T16:35:51.982824Z","alert_count":100,"request_count":50,"received_data":1605865,"sent_data":26547,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Complianz","description":"Complianz is a GDPR/CCPA Cookie Consent plugin that supports GDPR, DSGVO, CCPA and PIPEDA with a conditional Cookie Notice and customized Cookie Policy based on the results of the built-in Cookie Scan.","website":"https://complianz.io","common_platform_enumeration":"","icon":"Complianz.png","categories":["A/B Testing","Cookie compliance","WordPress plugins"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"Yoast SEO:25.9","description":"Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.","website":"https://yoast.com/wordpress/plugins/seo/","common_platform_enumeration":"","icon":"Yoast SEO.png","categories":["SEO","WordPress plugins"]},{"name":"Contact Form 7:6.1.1","description":"Contact Form 7 is an WordPress plugin which can manage multiple contact forms. The form supports Ajax-powered submitting, CAPTCHA, Akismet spam filtering.","website":"https://contactform7.com","common_platform_enumeration":"","icon":"Contact Form 7.png","categories":["WordPress plugins","Form builders"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-26T22:23:14.439231Z","alert_count":0,"request_count":1,"received_data":4092,"sent_data":559,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rainbets.vip/site-reviews-js-before","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"920996a91e3ef52ab523fb5e6136b64b","sha1":"7ae3d17ae60520c4840b79a214c4f1a8cb57f25b","sha256":"01b6e7e7a5841ace1fdf94b5686f2dca22b95c3a20f3fe7f08f744a7ff037243","sha512":"dc36c1a21bfc39a628f15b0f6280528e0c1c5895746e892e6310ef484e90094cc835afca4d4e4345c0beb75f2fdfe90e1f08241bc88f4db0bdc1062c08aad9fa","ssdeep":"48:hV17T5689TsZw0tJ/VF0qMpm0CR7JJUrQ3XJOTLjN:p796OL0tpVFEpm0CxZ3QTLjN","tlshash":"1d91e0c2deca3cef1e2615f574ccda0357e18294fe604c0bd619546a73cac83d25aea8","size":4465,"data":"","first_seen":"2026-07-28T16:36:04.380368Z","last_seen":"2026-07-28T16:46:04.203529Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=1784896351","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"8410163bf0c8c06654596933cc416ddf","sha1":"759865864b0623c382ff1a2c26a10efcd0125a70","sha256":"459822d33dd9667eb24b4e47156f05cd9276d5aeafcb1131c5a32f4c29a634a7","sha512":"2ea09bee476836c1458439a989e9a2013202965068c0f98496d797ab30a29fbba7b5bbab0faa4c658a34945da104cd7fd8bbd6be473d3fa4ac4e68de5ad5e031","ssdeep":"768:lW94cj/g8aGSJjv+lfzwLpstNIuWBxumxesKNVhIkYJO2ybEXoHVFnvhY/I+1URx:38aMSBchY/IlUCHC59KmmDECTr","tlshash":"8b13eab93e9cd0b516ee47ed37abab48f4303562d80f88509465dc542268dc60f9bfb1","size":45492,"data":"","first_seen":"2026-07-23T20:34:07.462598Z","last_seen":"2026-07-29T02:58:16.493757Z","times_seen":115,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.dmca.com/Badges/DMCABadgeHelper.min.js","fqdn":"images.dmca.com","domain":"dmca.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"bac6fb686027b93b6565e1b1e5e8e213","sha1":"e585bdd95488444f0ce2888d8281dbdaf73ca2ea","sha256":"e8021f1a9dad409f7e699457ac334653bf800464df69900237c4de1c29e275d0","sha512":"adee788b03089ef933d40b72a9ffe69742f4873788de6f20ebed6b2abc07895ff8f4b176a6bbfaee231ad27f479bad94e269b14cefdc569ece7e3d8dd9be8500","ssdeep":"","tlshash":"21f0aba88be2043e1d43f470593da74128b6406b300ecc01fd0cd6984f84b7913be9ed","size":465,"data":"","first_seen":"2023-03-07T01:02:48Z","last_seen":"2026-07-29T02:19:08.910514Z","times_seen":16833,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"3b4197ca8961c6575d40cd85e5248895","sha1":"d595e0575675670719a91903faa70b36fbbacad5","sha256":"8df316ee2087bd1ebd549fadcd0b69e6e0d58e0b3a5113d0fa54145ee049eaa4","sha512":"701bcf3714a53dcf3bee56f4fdab4c97cecb65d38652f6f447df7aa533ac6fa93684bf7aaec19a8ac5d8a469bbba4e9cee95b904c2f36d557dcdd2178b4d60f5","ssdeep":"","tlshash":"72e012bda9e154f0026bb1191a6fd620297204c7a4c49e047e5c4e5d1fa445c97e1a55","size":346,"data":"","first_seen":"2026-06-07T17:05:58.283171Z","last_seen":"2026-07-28T17:36:51.757274Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"7335be571d1f9586a0cf2f6952c4eec4","sha1":"f3b60c35f4f7b75ceb1266dbda8ac8d4b1ef11ce","sha256":"da1bed209470750a6c89d8f016d11e981ac975127f5db25aaf094404ecbec64f","sha512":"cebaf60fe3f7c0353c89f2de080ab49e6a5fd65040c113ae0d46f9b10f4b991b00bb15d61e287a60fe714a03569ee0fba4247de1acba85fd8ce02484aca505c1","ssdeep":"","tlshash":"91411868dbbe7662832ea0b62bfe52de143e547e7a814ebb7c38405048f48493715c7d","size":1934,"data":"","first_seen":"2026-06-10T08:18:22.002783Z","last_seen":"2026-07-28T16:58:18.486738Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"c35a67191117e90174938f756c5cd7dc","sha1":"d3fddce91e3b0f150d8c66587ab8130cfdcb438a","sha256":"f867304aa06b5218124f4cb784e97840c4f374c50292265931881b8254e973d7","sha512":"dcea992f859908c7f817992ddc6590b1a76d80e0c2c8fcacb6407aa668064a026741ef63dec19434bf41a64ed15e4ba9b3b7c24bda3f5b7b1f547e43c97eadec","ssdeep":"","tlshash":"15e0221263f0333100bf861422ca8a8e3ba04407be428f76696cc4061f84e94c8f48fe","size":367,"data":"","first_seen":"2026-06-07T17:05:58.289775Z","last_seen":"2026-07-28T16:46:04.196282Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"19c8e4608d5e2a4823d655adc688eb7c","sha1":"5b535e4ac13c32ad1b898ca4e23872e4877c2fdf","sha256":"64afb21670c28916c8a684475589bf027e68b131fef709874cce4b998e67e265","sha512":"c47e0ba61c89422b73d106801fab0b2ffc0555532fab8eddc5b92cc90e932daa75065f93280461796bc0a038f7552ec8a632ee445c64d303d9a8cc64e841b453","ssdeep":"","tlshash":"ad41ea25f37d243147bf64aa69e622de2a3d80823a478cb7cc9c8d0614c1e5d4a75cbe","size":1943,"data":"","first_seen":"2026-07-28T16:36:04.373764Z","last_seen":"2026-07-28T16:46:04.197718Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"e7c749255f0c7603b90f6196e3087ad6","sha1":"87ca6ed12bb4d899eb515fcbf1b06cd77bfecf35","sha256":"6c91320d2a35084146720e73b9eb506f8f042d304770136f76fdb279d3e82c90","sha512":"17c60dcf3f92c9719372b169ccdad70f329b88e816784043bc83bab6fae403aecab83deda08b8a8c2727ad201d11b2641646e45548d69e9accdadeb0566a3038","ssdeep":"","tlshash":"02b0128b74a73d50828fc7b44d23ba014510208782afc50875e59d3096718c0b4c352f","size":97,"data":"","first_seen":"2025-12-03T09:23:15.289558Z","last_seen":"2026-07-29T02:58:16.536326Z","times_seen":34509,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"002163d35a14de8377226f71f4c69731","sha1":"8aa592eb589dc72d6983af41653db2ce57ba825a","sha256":"8e2c6daf8befc5f6f4f3e14577b941ef149dae4175ab982d89c703ed102ed132","sha512":"f7512d391f15cf021a19017deed4ca33e05374e1658f9e68824262c21add4ad3d37347380659f4c2773a5048c24ea15c20f74b28ab93da98681aeb6c3e69eb35","ssdeep":"","tlshash":"46f0ac841c78a92645d2a2cb35aa7504b0acf910537f5d06b20f08491a50e6d9af3a5c","size":567,"data":"","first_seen":"2026-05-08T12:04:32.352388Z","last_seen":"2026-07-28T16:46:04.199239Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"d53b4fb420cae2d630f8a3261cf67fbd","sha1":"a5e33df0a33422bd561d996ecccbbf37e47dea55","sha256":"0d092d6dff4d9691be68ffe62f0267a1ff3f139ec3a60da487e94c2e6eb54d04","sha512":"bbf98d42736f186ac4325664c2cd5d1199f5ba77cc72f9e805e9989994120fb6945277b3b14ace2d0182467f128e28f574d8fab87e1b035b509430b03f538135","ssdeep":"","tlshash":"83c08cae99a82c8a24eac249017c1310b118a513ce1f1e19f24e004cafa80b9b9196ce","size":169,"data":"","first_seen":"2026-07-28T16:36:04.375632Z","last_seen":"2026-07-28T16:46:04.199837Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"420ed08b1e25eb08b8fb915a4a167e4f","sha1":"f53d139e675bee55d08a1c2b4f2c15357337fc87","sha256":"9327f8d76de9f0e6bb020c4b5ed515fb7eb2d9872c29e8a7dd128add2d330088","sha512":"04fbb5ea8afa9d4fb6f93a0b2d2f47cd8bd2f78d8808f7163e5b76077ff654a29ad77288d1d1e6b1b1baf066fdb15e8ac210eb53ab528f5670831fc2596c14ad","ssdeep":"","tlshash":"ed41d1c25ece3cef1e2615c574ccde1357e18294fe604d0bd619546a73cac83d25aea8","size":1963,"data":"","first_seen":"2026-07-28T16:36:04.37659Z","last_seen":"2026-07-28T16:46:04.200539Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"41059b1a81b5c9a9c164c05efe2e1045","sha1":"7d76b20f1d8bf1a8369a0e350b426d4180148def","sha256":"d2295a38a468dfb72f7ee47b2387d2739878377c053a84096f618a160f89cae0","sha512":"1eca4656474d7eee3f4b4eadcbaa0304ef9ae48ebd4c3c1217b7f54ef1c349a0d3c68977770def8f1b29b6da21d95219a14418d26ce33a8d13c9173996b8ccfa","ssdeep":"","tlshash":"f911f03b3b7c90f947c4a3c40a440d2ba1cc5140e49e9958d189ec2c06bc357174ef17","size":1082,"data":"","first_seen":"2026-07-28T16:36:04.377585Z","last_seen":"2026-07-28T16:46:04.201215Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-includes/js/dist/hooks.min.js?ver=7496969728ca0f95732d","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"55c5129ccd0fa8f383d9de82a91c5877","sha1":"596918015fa62e4f18533b69b0e6822ebee3cb2d","sha256":"cce388fed1a82ebd20ce7d9601e4b6c83a425ea201c333d71b1183ee887cc090","sha512":"956ab39b4bc0577f0ac50a842bc7f71ac1d5b6f7148f9ba9bdb2a84001b96362f077d417144dce171464de8aac71ffd6e639e35ca12da4de2d12fddd660e64a3","ssdeep":"96:lu/16WIHBLusBcADGDd/R5h2RTLlD3jMXY2yGy94E34sTY2Cif:lGIhNBcAD0NRv8XlD3wXY2yH+EoaY2f","tlshash":"5ca151c43542b930e2b77027f0ab58d46175abe1a82d8446d59cd8f12da39cee0e7b3d","size":5050,"data":"","first_seen":"2026-07-02T22:01:42.321596Z","last_seen":"2026-07-29T03:25:18.655616Z","times_seen":11513,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-i18n-js-after","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"947175d84ae64c301871b0268306b103","sha1":"7a0eea3eacbe74c0626ba43cbaafc45b86093870","sha256":"ea5eab37926d2aa57c171e1820f8a0e442a6b82da539bb433dbb355d3fe382c3","sha512":"8f1e4dc50c8404c6f987af8e47f612a814723f66a101312f319f31865ab37f9d02a0925b2e28fdec5f1b5d80c788a811597caf2c7986bfdf3e8ee16f9d2d31e6","ssdeep":"","tlshash":"c75112cbf4ab3d50828fc7b48d23be0145502487c2afd50875e59d3496718c0b4c362f","size":2575,"data":"","first_seen":"2026-01-05T03:42:31.144402Z","last_seen":"2026-07-28T16:46:04.20191Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.1","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"2912c657d0592cc532dff73d0d2ce7bb","sha1":"70a679e2769825236f83bcc56965a9d0bd86c4e9","sha256":"ddcce687729cb358abf9d0d8e1217a097859be2b0d18c23d7c851b38c87bc9c0","sha512":"9646384e65d09bf00cb20365f43e06dd41e7428e3fc6cc2737f4e69b50f006ebb25bd24a566fcd9faec2f0dcb24404e25d57ba7b8c6aba61797a29c515ad5144","ssdeep":"384:IsIRHeFJ1yQ7QdfnJgeYh7MXlsNqrBp1pgQpwOjNtqohIQ/5Z:IsIR+L1yQ7QdpYh7M1iqrBp1pgQpwOjn","tlshash":"0a52d7a1472955321eb506e391e513c1769075aef44b8aa1a898dc2e18bdcc328f3ff7","size":13452,"data":"","first_seen":"2024-11-04T17:50:00.022634Z","last_seen":"2026-07-29T03:16:06.426577Z","times_seen":228733,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/plugins/site-reviews/assets/scripts/site-reviews.js?ver=7.2.13","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"966eee900d7086888c6bd24e345ef1ac","sha1":"491665f686c464cd80b35807c865dd9ba9586c44","sha256":"bc595c8641415c3d16715855939a7a0edfc323acca2a3c6869effa7548e05156","sha512":"5d7152d312ca977277ad81dc638c392fe60616e426dd3867bce3d001dfb541689374d17ce16d39ea3a126ff84b1e2059ec8c028afde62a69481988846792dfa1","ssdeep":"768:Z1m1pnPP6/DE5wVrjS/zP1bjV9YIt9+scklUzJNw6KtC3p/8kUr7W35L9XIa5zQa:LDESVre/zP1vV95t9SWgLt27W35LP5zH","tlshash":"7a13d9967356b4330aea41f6a0365382b332618c7805805cf478ecee1e69d8a7777f76","size":42592,"data":"","first_seen":"2025-03-01T11:52:27.461641Z","last_seen":"2026-07-28T22:02:06.942974Z","times_seen":2022,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/contact-form-7-js-translations","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"b17bdd6b51320fffa409b56fcb345292","sha1":"e7da7f99df67a5ffc3bce090d7498b671e01760f","sha256":"9d604f05c5a04857753c562eb9ed00bfbc088ec374bd02d96b1f1dcb80f1ca7f","sha512":"90fbaa8dc4ebbd62b86b876f2286bf8fb8f0a5087a0f1cc84389b9d58fd90ca738388c9fc5359438a6f6abcba357e641f7f472f4840124cb42b80ea5219f8d46","ssdeep":"","tlshash":"e951a244dc78d92645d2a1fb35aa7904706cf510d37f5d06720f08491951f6d9af395c","size":3050,"data":"","first_seen":"2026-07-28T16:36:04.378502Z","last_seen":"2026-07-28T16:46:04.205018Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/cmplz-cookiebanner-js-extra","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"d85530274dd34d041daaf11daae74e95","sha1":"c179b3a800842bafcc8ff57fe811e85e626542a9","sha256":"4a34eebc46bf5e0b3b688e4256ab2d6f5000e1c73e16ac95be3c54ea291548df","sha512":"3bd050cebb4095fc95cc91df76d73319c5b384177e166ec581f4d616b551e560e084cf22d3402f8c3ae2dfca884dab7b926c3a07ab0c549d352156f78c918073","ssdeep":"","tlshash":"4771dd3bea7c90b987c4a3f40a480d2ba1cc5140e49a9958d189ec2c06ac357174ef17","size":3589,"data":"","first_seen":"2026-07-28T16:36:04.371109Z","last_seen":"2026-07-28T16:46:04.204297Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-includes/js/dist/i18n.min.js?ver=781d11515ad3d91786ec","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"12ebec1b36678eb1da4412af6c65751a","sha1":"4cb5d87353d9a06fde067063787a4beed692ba77","sha256":"558ae0ec83cc88de0929fde86b87c231246aafa9c961ebffb3257b05f62ca5cf","sha512":"a1bbd93277a59086bf27da7dcc60434b717ac521bce0618aef7c914789497a22cf56441a7f300f1bb7a6de56ca624226883d048f6eadbcc049dc717338189bb6","ssdeep":"96:IE7/RPgrMs4WLJOmlWS33c0xyE2B1596NiH826V0NG7CXMGOyd/sEomkKvYCGaMe:3hgws4WTBYNB1C9aNwAMPyd0R3SGaMSL","tlshash":"fdc1a7c975daf056235910a594afb005e134be2870debc00aae0c4957eb44cdb2b7fba","size":5732,"data":"","first_seen":"2026-07-02T22:01:42.315643Z","last_seen":"2026-07-29T03:25:18.677624Z","times_seen":11261,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.1","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"96e7dc3f0e8559e4a3f3ca40b17ab9c3","sha1":"d363d0291e92c233e828023583dcf6685f2da5a2","sha256":"29fdd17a7002a2e1bbd9b33adafc53457c64006b5aca8f6e4dbf907de35433ca","sha512":"851dcea59510a12dd72c8391a9ea6ffa96bcbe0f009037d7a0b6e27bae63a494709b6eee912b5ed8d25605fbb767a885f543915996f8a8aff34395992e3332dc","ssdeep":"384:wwuf8OQL0sARrAZcNWLq/+Ffm/hibLexa2VautyX2fsL3ZHO1O9H:wwuf8OQL0sAZAGNWmGcibLexa2Vau0XD","tlshash":"d34235e16197e0f0c7c338a48816c051f2bf866cb9898054fb5dcdd22d5de07626b77a","size":12512,"data":"","first_seen":"2025-03-11T19:47:45.42406Z","last_seen":"2026-07-29T03:16:06.388662Z","times_seen":221272,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/contact-form-7-js-before","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"86647d8b9038c58a019d27005e630a15","sha1":"b1213bcebcac844ef2514d2da697feb83018f71b","sha256":"05706a41e1dbaed8d246e8cb85f81605c1f5f4ada29bf004de5dfd7435b799a0","sha512":"f960fb27e7bd2cb1ff1d1c8b338d7bba1fccf8923610b25c08e15fc52ad3988c16d6eda52d9c2c4dd86ef2af9dec519a2bc74506e59c2c7ac30dfcb1924fd705","ssdeep":"","tlshash":"4851809ed5a81c4524eac179057c1310b114a517ce1f5e15f24d004c6fa80b979195ce","size":2660,"data":"","first_seen":"2026-07-28T16:36:04.379396Z","last_seen":"2026-07-28T16:46:04.202859Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/themes/starter-kit/js/main.js?ver=1.0.3","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"84b71e1835eb9020c7ca700d1aabbf37","sha1":"dc7dd60e16969e6df9d55ca14522ae8ac23707d0","sha256":"0a218b269cc8ae4a4c3b0367add047275973fbe05b152812268dd46bf9b7b82f","sha512":"e1bb3b4a7c978c8ab81c13fd907a9f59ee38d1959af69384c9f06cb4f94b6b3c24561caaa4283aa14177e63f9d3a2a68d97fb25c53174269ad10b6db66bbade6","ssdeep":"192:aB6Lk0IbL9op5vQo6PeoP0vpRJC7lxBFKJ6TQxTEvmgiE/mqjVdGg9sqU34ZOApw:140WLEIo7w3XtvF/mqRdGsgAzItj","tlshash":"e9423e6562712c3a46b26a224e371b05fb3850636542c26e3e1fb68c1ff08918792ffd","size":12119,"data":"","first_seen":"2026-06-07T17:05:58.096609Z","last_seen":"2026-07-28T16:46:04.180532Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/1xbet-2.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.965Z","timestamp":1785257103965,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/1xbet-2.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 21310\r\nlast-modified: Tue, 07 Jul 2026 09:56:02 GMT\r\netag: \"6a4ccd32-533e\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21310,"size_decoded":21655,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"77eec379564edb6287104dfda9645466","sha1":"341adf4051f285ba548cdea4569a7547098ea883","sha256":"a1342708a6d7976d0ae545897dcfeef18e26cb9792b098ac8a72999d78416d17","sha512":"4aab9dc2c8f5fa606939a1588a9d5e9c04754b8ebdc7d6934f05ee3efc0a2c0cf8c2659e3b103f359388e94d1efe75c0aaac1477f2739d2d47ff2af666afd562","ssdeep":"384:XwTxfReHXGpEudnM4xN54obhB4lguiukpxHIPIso8sbCSkGCfIvIcAQ8N:ATxfEHXOJxfxuvk7TzbCvG5rAQ8","tlshash":"24a2bf4acea20493d357cef92ac497824b79926ac429e03549b1460163efcd49e6cfcd","first_seen":"2026-05-10T08:25:06.379303Z","last_seen":"2026-07-28T16:46:04.168838Z","times_seen":10,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-includes/js/dist/hooks.min.js?ver=7496969728ca0f95732d","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.936Z","timestamp":1785257103936,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-includes/js/dist/hooks.min.js?ver=7496969728ca0f95732d HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Tue, 28 Jul 2026 14:17:41 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a68ba05-13ba\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5050,"size_decoded":2205,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (5014)","md5":"55c5129ccd0fa8f383d9de82a91c5877","sha1":"596918015fa62e4f18533b69b0e6822ebee3cb2d","sha256":"cce388fed1a82ebd20ce7d9601e4b6c83a425ea201c333d71b1183ee887cc090","sha512":"956ab39b4bc0577f0ac50a842bc7f71ac1d5b6f7148f9ba9bdb2a84001b96362f077d417144dce171464de8aac71ffd6e639e35ca12da4de2d12fddd660e64a3","ssdeep":"96:lu/16WIHBLusBcADGDd/R5h2RTLlD3jMXY2yGy94E34sTY2Cif:lGIhNBcAD0NRv8XlD3wXY2yH+EoaY2f","tlshash":"5ca151c43542b930e2b77027f0ab58d46175abe1a82d8446d59cd8f12da39cee0e7b3d","first_seen":"2026-07-02T22:01:42.321596Z","last_seen":"2026-07-29T03:25:18.655616Z","times_seen":11513,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/casea.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.960Z","timestamp":1785257103960,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/casea.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4626\r\nlast-modified: Tue, 07 Jul 2026 09:56:02 GMT\r\netag: \"6a4ccd32-1212\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4626,"size_decoded":4970,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"99854d0a11a9071b5bd0c7b524240ec4","sha1":"cf6a6a259afdadcfe429374ad3a0d51e30c9262d","sha256":"333b32661434cb1ae472903224465055af7f02193ac37189529020f6204276d6","sha512":"017b2a49e749a74b0f8b61217bbffe0a88b766d7441410b96d0672b3b4826b3edb71c4e139206dc9d734b68fd1593e91b9030969ee93b0824ab027a7943110a1","ssdeep":"96:gElbw+iZT9OliRStMUZedQGjvTOIimJV8endhCPllse5DHFmEF:FwjGiRStlopj7OIisVNdAPbxF1","tlshash":"45918d712f4653bdc1180af80b69f18b83ddb03cc1ee466b54940023be614e6acd1ec7","first_seen":"2026-07-03T10:53:35.713042Z","last_seen":"2026-07-28T16:46:04.179954Z","times_seen":11,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/Logo-black-2-scaled-1-1-1.png","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.959Z","timestamp":1785257103959,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/Logo-black-2-scaled-1-1-1.png HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/png\r\ncontent-length: 35674\r\nlast-modified: Tue, 07 Jul 2026 09:56:02 GMT\r\netag: \"6a4ccd32-8b5a\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":35674,"size_decoded":36018,"mime_type":"image/png","magic":"PNG image data, 240 x 112, 8-bit/color RGBA, non-interlaced","md5":"e3e7d3767b0ec1a8dc053f8a6d64b7c3","sha1":"f56d4cfe52e6207ea2ba7f4727e6f6b78f50042b","sha256":"1e9e342045c462ea2050b85f8489f560c2fc245da8136cae9e98827940748553","sha512":"b080ad48f4b33103f3f1c41a12e0e578f2951cada4ee3418922ffd983499cb37686ef31319eb01ab5dc5d3ba0d1512e627204b7947360b1d1e0b967859f7421d","ssdeep":"768:nLPNALQ1XHGFOHLLT6eDDHhV8x0oLu5agG3oAz9vVq+:nd1XH80LLu6HTN+u5ag89zxVJ","tlshash":"cbf2f1e25e5952b49d18e328cf00d16a573f196e80ff3a9f88f84f24132ee5ee40465a","first_seen":"2026-06-22T07:10:50.454495Z","last_seen":"2026-07-28T16:46:04.163952Z","times_seen":12,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/slot-mafia-logo-1-1-8.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.963Z","timestamp":1785257103963,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/slot-mafia-logo-1-1-8.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 13870\r\nlast-modified: Tue, 07 Jul 2026 09:56:02 GMT\r\netag: \"6a4ccd32-362e\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13870,"size_decoded":14215,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8c8c0ec5bca8f1f3fb84bbaaa30919c1","sha1":"865dcf4b34ce4bae99d0ca36f2540b86f6553b92","sha256":"95a61edb440db2381ee48a9fab1c8a2bfe4b92937290a3d8727e6f8f91e0cc4d","sha512":"eeb46b1c393045bfa5e6fa34c93c31c32c18b322696606ee1ab3f34fe8408057b1c91e71d9c8a5aa505891ea0bcd7d51ea05712705bb55e1f50aa37d4cf81d20","ssdeep":"384:8wTcpa/ZFsVhzQdTn/tXBVBWsfBh5u+OOC61hcHr:JTGGiQdT/txnWspX4N61KL","tlshash":"21529c22433152e4ce635dbb23da3304e5f4aef9171d85a8641f22e55bb6abb210c91f","first_seen":"2025-11-13T03:52:08.192508Z","last_seen":"2026-07-28T16:46:04.183097Z","times_seen":10,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-create-an-account.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.973Z","timestamp":1785257103973,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-create-an-account.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 41046\r\nlast-modified: Tue, 07 Jul 2026 12:35:19 GMT\r\netag: \"6a4cf287-a056\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41046,"size_decoded":41391,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8a5eebb5508df90a1f7242b5b214cd22","sha1":"1147b57db649cdec1087afdcbc35f3e07153767b","sha256":"5e5a7448c2001344e30a9a867abc94a5b8da724cc797a60699168751455cf49a","sha512":"6ba0d0c5a43815f35c2e18038b3d7b5e226e88b175ff90c84dda3c7dc162e81e2e934d26fea363b5e949203fd270c430a632bcfe6b3aae8029eb0d0f5e0b0af7","ssdeep":"768:KIunSssf95DR/bDVPeBtcKBTh5XNbUs4SswRuxPuUSCir4p/YBCDKrXY:KI5f9BR/bDVPotJThIGs8uPNSBKQBCDR","tlshash":"c003f15b4a5289cd9bd77b1ce8070d23042ddee639e3812b4a59af11f0782fa759d02f","first_seen":"2026-07-28T16:36:04.33637Z","last_seen":"2026-07-28T16:46:04.187893Z","times_seen":3,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-app-ios-iphone.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.975Z","timestamp":1785257103975,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-app-ios-iphone.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 57790\r\nlast-modified: Tue, 07 Jul 2026 12:35:18 GMT\r\netag: \"6a4cf286-e1be\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":57790,"size_decoded":58135,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b3a9a10be382a3315c8d391fb33e9877","sha1":"0a4678f728a54b243249b34e85aa66a017a2e7e3","sha256":"dbe5510f7c4e43570841fbb5091cd9f376e06dea83600b2772fc39d7ecfdd5b8","sha512":"6f019be2f4181588bc57582b79f43a1f95cd523af24e232f1b349c9cc659210a500bfb7b8ca35590f7292531f4f1174d003a720107e775f8c08ffcec5b66948b","ssdeep":"1536:PkMbcYf6YvE7t2CVJqGOT73y5GrkzZxYX:PkLYfg2VGqiigZxYX","tlshash":"324302b6b7c0c25d403f2a3c624df89e318dee76ab079d681948f737a46e7d9498c900","first_seen":"2026-07-28T16:36:04.337364Z","last_seen":"2026-07-28T16:46:04.166704Z","times_seen":3,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-rewards.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.981Z","timestamp":1785257103981,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-rewards.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 40164\r\nlast-modified: Tue, 07 Jul 2026 12:53:35 GMT\r\netag: \"6a4cf6cf-9ce4\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":40164,"size_decoded":40509,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5dc9127a40187b4015cdc3bcc4eeecd9","sha1":"fbc7096385074cbc8d6f07240824f8669ef1af30","sha256":"58891f3c3ef5fbfa7fe596659a61b08ebb8fbf4787a2e54ed818a38fd0d9680e","sha512":"b3642114cb83c0a96ac798bf359d554fa781fc33475b07ce73ecea6d003bc1d49f44e8670daca6000bceddcf1465b12a6add3c6d1504d5514062334fe926ebf6","ssdeep":"768:PQIiZqa1sn43uir4hmtr7JbzkVbGIk1Pqa8nGIJ9DtQsAKV5aqJ3E:IIikaKnmuytHJEFGIJFtQsZP13E","tlshash":"7e03e17a7a8503e0d20bf158cec76f5bc4a74b63c4962759b1e61ce07fa502143976e8","first_seen":"2026-07-28T16:36:04.365084Z","last_seen":"2026-07-28T16:46:04.188553Z","times_seen":3,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-menu.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.979Z","timestamp":1785257103979,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-menu.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 42018\r\nlast-modified: Tue, 07 Jul 2026 12:53:34 GMT\r\netag: \"6a4cf6ce-a422\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":42018,"size_decoded":42363,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5998c5c1ac4553c6a5aac482d359c242","sha1":"5a82678d4d801fe5698a977c91e7068693f68e84","sha256":"d643cbecc14ce700cb68fa9b42b3b1892c2c0d7148c45036b1daf31a5a0c0752","sha512":"99a71ad5c34a51c268870e53e2742d09d339e9820be1fe248865da85f4447b6ec93e075db20c7554fe354672ec27dfe0dbaa91600d60b62ced5d088a7f1ea4ab","ssdeep":"768:Is2U7qB5x2790VKHbrCD+PooYTXWN95de0a0ngGgHy23LJ1w1jHX1ge2nEJU9F7/:4gqB7K90oCDnYj3VnngH17JCVlgewEa/","tlshash":"f413e1b4edec40ee81dc520a09cd2c74c87b1b458d9082a0a7f879eb9c16ae05dd2f4f","first_seen":"2026-07-28T16:36:04.35528Z","last_seen":"2026-07-28T16:46:04.171029Z","times_seen":3,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/themes/starter-kit/js/main.js?ver=1.0.3","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.941Z","timestamp":1785257103941,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/themes/starter-kit/js/main.js?ver=1.0.3 HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Tue, 28 Jul 2026 14:31:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a68bd24-2f57\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12119,"size_decoded":3652,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (4059), with CRLF line terminators","md5":"84b71e1835eb9020c7ca700d1aabbf37","sha1":"dc7dd60e16969e6df9d55ca14522ae8ac23707d0","sha256":"0a218b269cc8ae4a4c3b0367add047275973fbe05b152812268dd46bf9b7b82f","sha512":"e1bb3b4a7c978c8ab81c13fd907a9f59ee38d1959af69384c9f06cb4f94b6b3c24561caaa4283aa14177e63f9d3a2a68d97fb25c53174269ad10b6db66bbade6","ssdeep":"192:aB6Lk0IbL9op5vQo6PeoP0vpRJC7lxBFKJ6TQxTEvmgiE/mqjVdGg9sqU34ZOApw:140WLEIo7w3XtvF/mqRdGsgAzItj","tlshash":"e9423e6562712c3a46b26a224e371b05fb3850636542c26e3e1fb68c1ff08918792ffd","first_seen":"2026-06-07T17:05:58.096609Z","last_seen":"2026-07-28T16:46:04.180532Z","times_seen":7,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=DM+Sans:opsz,wght@9..40,400;9..40,500;9..40,600;9..40,700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.916Z","timestamp":1785257103916,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /css2?family=DM+Sans:opsz,wght@9..40,400;9..40,500;9..40,600;9..40,700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 28 Jul 2026 16:45:03 GMT\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3408,"size_decoded":1120,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"ea4ef1b58461cc811a47cc9fdcab61a1","sha1":"155779c0daf2ef7c7f64ec41edad480c09da941b","sha256":"40522150a1e943dad5c88314d6a9c235b312d2d6beb893e8cb6b46a6825ed3b2","sha512":"26cc96e07b4c262d39d35758075140d1becd6980401a612d83b34339f35dab7bb2635c51e914a7d07c7f82971ae109966b569263c029e7a275d1f96a6e4d5e23","ssdeep":"","tlshash":"8b61ac81046bb114db572cc122cd7e32ef1f619164549874aafe2888fcaad6e5361b4d","first_seen":"2025-09-16T12:22:54.356027Z","last_seen":"2026-07-28T16:46:04.174597Z","times_seen":80,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":0,"connect":16,"send":0,"wait":35,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-casino-preview.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.927Z","timestamp":1785257103927,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-casino-preview.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 22376\r\nlast-modified: Wed, 01 Jul 2026 10:16:04 GMT\r\netag: \"6a44e8e4-5768\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22376,"size_decoded":22721,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2eac3f1222db00133d45c23de07267b9","sha1":"ddb9aab6bd8d8a8b3f7901bd748c222ef3a69b74","sha256":"67fbae5842db9fa022f3350f23772588a9c88d828a036411746fe32c517a9b96","sha512":"4113d0b46947ea05461e856685dff777fced25f2ef924a8bbfb798fe3484b6137099e743f697a82f9391b0577866b74e1f0283408f17aa20828344f88f8c29ff","ssdeep":"384:MN8m/Jbd2hFgff3SjKTnw4CfBSGgCUKSiZJyqlRd1YwrMb0uz3UqW5bTlQ2+SyWO:u8mZshWX3S2nw4CfY3mbz1PrMQlqUSTp","tlshash":"19a2e1968004eb638ada1c16437ef3c2ecbf3447b12859893ca37735e85c289455a0bb","first_seen":"2026-07-28T16:36:04.364083Z","last_seen":"2026-07-28T16:46:04.163397Z","times_seen":3,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.1","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.939Z","timestamp":1785257103939,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.1 HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Sat, 30 Aug 2025 09:32:37 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68b2c535-30e0\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12512,"size_decoded":3879,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (12512), with no line terminators","md5":"96e7dc3f0e8559e4a3f3ca40b17ab9c3","sha1":"d363d0291e92c233e828023583dcf6685f2da5a2","sha256":"29fdd17a7002a2e1bbd9b33adafc53457c64006b5aca8f6e4dbf907de35433ca","sha512":"851dcea59510a12dd72c8391a9ea6ffa96bcbe0f009037d7a0b6e27bae63a494709b6eee912b5ed8d25605fbb767a885f543915996f8a8aff34395992e3332dc","ssdeep":"384:wwuf8OQL0sARrAZcNWLq/+Ffm/hibLexa2VautyX2fsL3ZHO1O9H:wwuf8OQL0sAZAGNWmGcibLexa2Vau0XD","tlshash":"d34235e16197e0f0c7c338a48816c051f2bf866cb9898054fb5dcdd22d5de07626b77a","first_seen":"2025-03-11T19:47:45.42406Z","last_seen":"2026-07-29T03:16:06.388662Z","times_seen":221272,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/themes/starter-kit/images/rating/badge-1.svg","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.951Z","timestamp":1785257103951,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/themes/starter-kit/images/rating/badge-1.svg HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 28 Jul 2026 14:31:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a68bd24-5fe\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1534,"size_decoded":1098,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"64a832d2a41fe3c9035f305366cd00b0","sha1":"75abbc24c6efd1bf1cf81332b149a7fbf059a609","sha256":"889ee0275f0ebef2da49a348e54930f4e1661afaf111b8f25102aa9352788c0e","sha512":"da758f48497427d11d4f77cab781459a8fd6191731aa1ce2dacd0a0af4c48ba2f265f4b7109bda3f653d1c9eac13d56c93dd05bb963666b4a0e5adaf3eb3c612","ssdeep":"","tlshash":"6131957ea10d2c2af12885bc9e12c4791476bcf70cc2100146e1b9abe0a74c60ceaa5f","first_seen":"2025-06-05T18:04:56.815714Z","last_seen":"2026-07-28T17:12:01.688464Z","times_seen":67,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-legal-status-canada.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.977Z","timestamp":1785257103977,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-legal-status-canada.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 72332\r\nlast-modified: Tue, 07 Jul 2026 12:39:41 GMT\r\netag: \"6a4cf38d-11a8c\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":72332,"size_decoded":72678,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8e05ad0d79aee97cadf3c9ffa1960215","sha1":"78fe874716de4ad07383b821050d06f9a686ddf2","sha256":"a3fa9bc9f5e9537b75ff05f87cadadf9f266ad3cc17332feea08111636cc203f","sha512":"f7d4b963ff41452a6f2c963e5acead66bb8d4aca2d17e7dec70d749062e7c2f1765874eef734367674f40322b67f7f02064a775265ac66a1d292b2d4366453ee","ssdeep":"1536:aO0TZxHRAcqYUCZfllwFeer54iuNIuiUGdhmHAGDfhUE:LaxVqjClwrt4VNVtGOAGDJF","tlshash":"6d6302532aec37e2590482328f75d6002645fa94feb747431db302bf5fc4a1a8ef55aa","first_seen":"2026-07-28T16:36:04.332337Z","last_seen":"2026-07-28T16:46:04.169459Z","times_seen":3,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-28T16:45:02.417Z","timestamp":1785257102417,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nlink: \u003chttps://rainbets.vip/wp-json/\u003e; rel=\"https://api.w.org/\", \u003chttps://rainbets.vip/wp-json/wp/v2/pages/2\u003e; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\", \u003chttps://rainbets.vip/\u003e; rel=shortlink\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Complianz","description":"Complianz is a GDPR/CCPA Cookie Consent plugin that supports GDPR, DSGVO, CCPA and PIPEDA with a conditional Cookie Notice and customized Cookie Policy based on the results of the built-in Cookie Scan.","website":"https://complianz.io","common_platform_enumeration":"","icon":"Complianz.png","categories":["A/B Testing","Cookie compliance","WordPress plugins"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"Yoast SEO:25.9","description":"Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.","website":"https://yoast.com/wordpress/plugins/seo/","common_platform_enumeration":"","icon":"Yoast SEO.png","categories":["SEO","WordPress plugins"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Contact Form 7:6.1.1","description":"Contact Form 7 is an WordPress plugin which can manage multiple contact forms. The form supports Ajax-powered submitting, CAPTCHA, Akismet spam filtering.","website":"https://contactform7.com","common_platform_enumeration":"","icon":"Contact Form 7.png","categories":["WordPress plugins","Form builders"]}],"data":{"size":217338,"size_decoded":42081,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (9139)","md5":"796868a0cb5f850410ea90f42c0aad1d","sha1":"7b706b924b4361dfd667d21d745500f11c5a9321","sha256":"54d0f199ae85e2b501eb19d328c0cc2046a3a34d4d5a5b8b0a190c52d93d3543","sha512":"536fda5d255762df68ac02e4a8a2082909b7461e64105c358dde6e986dd53f0b60019a992fced93758515a035c25618ac29cc2527252d10323189650644a7cf5","ssdeep":"3072:b/pPPrKmeaX3rt7sTH2VCJmF9sKA8PanLWhzpG4CAME1ALGD:rFKmeeA6","tlshash":"7e240866439460b9322ba3ac5d49b31db53d9203de0245e8b0efc145afd6f9289b7f0d","first_seen":"2026-07-28T16:45:34.261006Z","last_seen":"2026-07-28T16:45:34.261006Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1146,"timings":{"blocked":0,"dns":3,"connect":19,"send":0,"wait":1097,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-includes/js/dist/i18n.min.js?ver=781d11515ad3d91786ec","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.938Z","timestamp":1785257103938,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-includes/js/dist/i18n.min.js?ver=781d11515ad3d91786ec HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Tue, 28 Jul 2026 14:17:41 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a68ba05-1664\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5732,"size_decoded":2841,"mime_type":"application/javascript; charset=utf-8","magic":"data","md5":"12ebec1b36678eb1da4412af6c65751a","sha1":"4cb5d87353d9a06fde067063787a4beed692ba77","sha256":"558ae0ec83cc88de0929fde86b87c231246aafa9c961ebffb3257b05f62ca5cf","sha512":"a1bbd93277a59086bf27da7dcc60434b717ac521bce0618aef7c914789497a22cf56441a7f300f1bb7a6de56ca624226883d048f6eadbcc049dc717338189bb6","ssdeep":"96:IE7/RPgrMs4WLJOmlWS33c0xyE2B1596NiH826V0NG7CXMGOyd/sEomkKvYCGaMe:3hgws4WTBYNB1C9aNwAMPyd0R3SGaMSL","tlshash":"fdc1a7c975daf056235910a594afb005e134be2870debc00aae0c4957eb44cdb2b7fba","first_seen":"2026-07-02T22:01:42.315643Z","last_seen":"2026-07-29T03:25:18.677624Z","times_seen":11261,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-vip-rewards-program.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.969Z","timestamp":1785257103969,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-vip-rewards-program.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 51436\r\nlast-modified: Tue, 07 Jul 2026 12:35:17 GMT\r\netag: \"6a4cf285-c8ec\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":51436,"size_decoded":51781,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"47cf73e1076c9917a12f26287ce553cf","sha1":"7bd74a8bc7ccb6a61e74d917df460233c39350fa","sha256":"f7bb62d7a45d9cbb9e0e7956e0e47401c3e61afeb8aa600bb6380c4792831a63","sha512":"4cfa4f650b847b6b68022d48a8d082e1b8b61d87126168265f5e14af270aaad7f3290f8390be75c316250483caa6dd7c8956dd86e2ef5e7f0b9ba9415e9f1081","ssdeep":"1536:U9+1/KtjCYwahy+R9Sm1NE5RKvmefnnHMd:glb0+R971iL4nM","tlshash":"cb33019ef3a45908a0cf4ba0da9f44dc239bceb61b084d7a60b675813abdd243d1d4c8","first_seen":"2026-07-28T16:36:04.352878Z","last_seen":"2026-07-28T16:46:04.178316Z","times_seen":3,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:04.216Z","timestamp":1785257104216,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rainbets.vip\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 62460\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 22 Jul 2026 13:11:12 GMT\r\nexpires: Thu, 22 Jul 2027 13:11:12 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 10 Sep 2025 16:30:17 GMT\r\ncontent-type: font/woff2\r\nage: 531232\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":62460,"size_decoded":63273,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 62460, version 1.0","md5":"4c04ee82dc1deb4f32b244195d258e9b","sha1":"9bd2bc9c6f54075acd20589f87c17a73e3ab07b3","sha256":"ab72fd10c9ac5633c1f9ae4267864b674596062e023458e02973080bd1098904","sha512":"43bd417c75382fbcad7a44c73db7ec8e883bb505b63215ec67488eb205b61acd94031d5740bdf70cf413fcb126ac6a567b4c71831eeb063e5643fa0adc704895","ssdeep":"1536:Hjv9lkTtdw0aS3yPvWdfDSFdW6KK8zPJ86DQMBXQX:Hz9ceS3y2FDSFdRKNzPJj5gX","tlshash":"8753028264d3489c8c8b69d354847f1c707ef88fc1b88995a8e33ca14d4b1e6e85ad7f","first_seen":"2025-09-11T19:26:36.805532Z","last_seen":"2026-07-29T01:19:49.687542Z","times_seen":23641,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":49,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Hp2ywxg089UriCZ2IHTWCBl0-8RH9.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:04.218Z","timestamp":1785257104218,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Hp2ywxg089UriCZ2IHTWCBl0-8RH9.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rainbets.vip\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 31204\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 22 Jul 2026 14:56:15 GMT\r\nexpires: Thu, 22 Jul 2027 14:56:15 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 10 Sep 2025 16:30:26 GMT\r\ncontent-type: font/woff2\r\nage: 524929\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":31204,"size_decoded":32017,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 31204, version 1.0","md5":"644fb0923b00731d39d4d00d701f489b","sha1":"f7366f67d887653243faa2ca4e667fb390577e15","sha256":"53b35dda61b188937bb54ef16f8cbb018fdffad94b3f81c238bdaf764c77686e","sha512":"6569ec4d4a3d2b2f7aac556bcbb8fda83ea1985414979c0909bbc5910bd8f5bd69d1255626269faaacc1a64837501fb6fdb1ba902f84f5d213f49e88c5204fbd","ssdeep":"768:dvyQgaaXB0KgDAyWzjo9xOFqIoQ60ta3w1EOlWooyLDbY+5TMH:8fiDAyEj/FqIIw+ML3Y++H","tlshash":"f7e2f298012f52badff465100b34f7b1c8736ad9e5a243e9883d86f09b5d5e0f44bd94","first_seen":"2025-09-26T18:13:44.653047Z","last_seen":"2026-07-28T16:46:04.167315Z","times_seen":423,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":20,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/plugins/complianz-gdpr/assets/css/cookieblocker.min.css?ver=1784896350","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.920Z","timestamp":1785257103920,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/plugins/complianz-gdpr/assets/css/cookieblocker.min.css?ver=1784896350 HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 24 Jul 2026 12:32:30 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a635b5e-ade\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2782,"size_decoded":1069,"mime_type":"text/css","magic":"ASCII text, with very long lines (2782), with no line terminators","md5":"182c31e4b049004a343781556afe8606","sha1":"d37c351aeeadbb654d441621b611bed8d7104aa1","sha256":"afe6634c4de97ea6dd0824fa7ad34f551b6faede0ca95db78516165ab1610f47","sha512":"cbfdfc6c97bb4fc1be24576e61c6accedb203bb5b38054393256ae354851d6beb91bd3afac2d7e5bea7729b3aeb28579dedb848b344f7ee592228fabe7ffa7fc","ssdeep":"","tlshash":"305129756d931890b3feef052d80b9842a29f753c02e0dede162962cb1df586cde6345","first_seen":"2025-03-07T16:44:09.983719Z","last_seen":"2026-07-29T02:58:16.472295Z","times_seen":31298,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/bitcasino-1.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.954Z","timestamp":1785257103954,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/bitcasino-1.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9362\r\nlast-modified: Tue, 07 Jul 2026 09:56:02 GMT\r\netag: \"6a4ccd32-2492\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9362,"size_decoded":9706,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"45a64830863bb1449740b85506033954","sha1":"6111a0f2ff0065526011b3590319f53af7a20c09","sha256":"bacf01696063546164a3da9649124e604d5cbd2042cbf5e7d3b0f6ba6caaf2a9","sha512":"d21a90e35a3b41b29e2f635df7315c85f630c83971fb8469e500dcf5ba7cb77a31694ee9fb46d20ed421a8ab4cd37c2f58566523365f1578b6eafe3f0e503038","ssdeep":"192:KwHm25hWrorAic9ZU8wg1ja1t4U4txUFqQBn6RXTbAX+6/YRk0QxLFXV:KwGyQ+AiMa8zaHynUAmF+6gRyxZl","tlshash":"de12bf85d708cf0ef2e748ff26d4dbc5e168de04fbe9da11a2811a134b378a90d98083","first_seen":"2026-05-02T07:09:18.092445Z","last_seen":"2026-07-28T16:46:04.168341Z","times_seen":15,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-time-based-permanent-promotions.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.970Z","timestamp":1785257103970,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-time-based-permanent-promotions.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 53640\r\nlast-modified: Tue, 07 Jul 2026 12:35:15 GMT\r\netag: \"6a4cf283-d188\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":53640,"size_decoded":53985,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9f8f16834e758215167ae831205b4983","sha1":"bc58db43bce847efa7f12cc8db651e09b008a97b","sha256":"d70d6edebba4e31deae14f24dca664ee10c668e0c8944547c49a964c3a8c3c52","sha512":"d77c80a50eb377b85283f76e177aa72c8263b42275f38797c892fc9ffa9e8329b51545712aa6df1e7813a6ee031885eb367da1e16489b2b97607e0a62d4b5d4f","ssdeep":"1536:KFWkuAqXnbrQaZVZgYTd4NTdrszfC2sMjDbnqAfrqD:KHwrF3Z9d2rsz67MOA+","tlshash":"f83302dbe2a16b3dd7cfac2890c74dbf6746d318613758525225d106f582d4648e332f","first_seen":"2026-07-28T16:36:04.344134Z","last_seen":"2026-07-28T16:46:04.183622Z","times_seen":3,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-account-settings.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.983Z","timestamp":1785257103983,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-account-settings.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 39694\r\nlast-modified: Tue, 07 Jul 2026 12:53:37 GMT\r\netag: \"6a4cf6d1-9b0e\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39694,"size_decoded":40039,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"03e20afefd939a3c3cfc83d920cf3054","sha1":"064bfdec914fb7a00584f7e9cf47a8a0dbbeec0d","sha256":"c64d0eb29a5fb9eff7c58277782e4b584389ef1b081c4082364291e9c046c422","sha512":"42e03283751dbdd9828cb53f963b2d0d25ff3b82258cc9e33db4ce2dcad524b4f5545c7c3116bfa63724d6e26bb89b79fcc27b4d6682a4f2646b47385d094810","ssdeep":"768:KaNdJmqAR7siMoxfpggiXogW8Hz/CpSeUI6sAZHvJIo2z4z1:DNdJvARvMisXogXCpS66nvJnz1","tlshash":"5303e09d12c01b03495e32b98aff1b52ce235a3bf4859df5e6f64c3be91090069e6ad1","first_seen":"2026-07-28T16:36:04.346465Z","last_seen":"2026-07-28T16:46:04.191922Z","times_seen":3,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:04.215Z","timestamp":1785257104215,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rainbets.vip\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 62460\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 22 Jul 2026 13:11:12 GMT\r\nexpires: Thu, 22 Jul 2027 13:11:12 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 10 Sep 2025 16:30:17 GMT\r\ncontent-type: font/woff2\r\nage: 531232\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":62460,"size_decoded":63273,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 62460, version 1.0","md5":"4c04ee82dc1deb4f32b244195d258e9b","sha1":"9bd2bc9c6f54075acd20589f87c17a73e3ab07b3","sha256":"ab72fd10c9ac5633c1f9ae4267864b674596062e023458e02973080bd1098904","sha512":"43bd417c75382fbcad7a44c73db7ec8e883bb505b63215ec67488eb205b61acd94031d5740bdf70cf413fcb126ac6a567b4c71831eeb063e5643fa0adc704895","ssdeep":"1536:Hjv9lkTtdw0aS3yPvWdfDSFdW6KK8zPJ86DQMBXQX:Hz9ceS3y2FDSFdRKNzPJj5gX","tlshash":"8753028264d3489c8c8b69d354847f1c707ef88fc1b88995a8e33ca14d4b1e6e85ad7f","first_seen":"2025-09-11T19:26:36.805532Z","last_seen":"2026-07-29T01:19:49.687542Z","times_seen":23641,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":42,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/Rainbet-300x300.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:04.323Z","timestamp":1785257104323,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/Rainbet-300x300.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nCookie: p2_popup_unique_name=GVgRBVsdH0pWHVAI\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4726\r\nlast-modified: Wed, 01 Jul 2026 10:16:06 GMT\r\netag: \"6a44e8e6-1276\"\r\nexpires: Thu, 27 Aug 2026 16:45:04 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4726,"size_decoded":5070,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"42693a002e6f9961630965bbca1a7a8a","sha1":"933874d37523543e22bc0e39d53810351e692623","sha256":"88a8542fbd35b76ff2b686bfa03e649dbdd5efc748807ad21f33227db9551cf3","sha512":"bce38fc98a2fe1752513ba9afb8d7e31fd91f268f5e502fd68a26bfd4620f31d972129f1f5c827290499f139b367a6082103594c5ac3ca2ae4a0730fc7f2dfc6","ssdeep":"96:BxsK/yAYg3+KY6bBZBgJaeNUS3ftpgseyeEja+xG:BxHKAYHKv1fUZ1pvHmH","tlshash":"14a18eca7952943b7161814f2f29e74c4c0b179bbe6664f6d48e9f740706560fdc3851","first_seen":"2026-07-28T16:36:04.36701Z","last_seen":"2026-07-28T16:46:04.193707Z","times_seen":3,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-casino.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.950Z","timestamp":1785257103950,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-casino.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3390\r\nlast-modified: Wed, 01 Jul 2026 10:16:05 GMT\r\netag: \"6a44e8e5-d3e\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3390,"size_decoded":3733,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6e156fdf148130bec8ac286192d18a61","sha1":"771f97fc9f1ba2bb889003a34fd961fddac9c70a","sha256":"4f793260f4e8b4684f33c9e99eb00615b5edd23800e6a7c517ae6ccc422a65e8","sha512":"8094788395743be0f31b153d0efe6c9794cfaca69a36ac1acf031a807d44e5f93eaa978dae0eb61cc98da0a12e2303ff89831943350e4a3f4d8fd571d5e2dc30","ssdeep":"","tlshash":"2a616b69ba3f0e646d841bf0ccbb9c1f6342e09d92044c351975a1f8f58c8af0256d0a","first_seen":"2026-07-28T16:36:04.34919Z","last_seen":"2026-07-28T16:46:04.191426Z","times_seen":3,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-payments.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.980Z","timestamp":1785257103980,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-payments.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 28240\r\nlast-modified: Tue, 07 Jul 2026 12:53:35 GMT\r\netag: \"6a4cf6cf-6e50\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28240,"size_decoded":28585,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2baf99877f5a4fb7ebf00265b08b0ad2","sha1":"a182a4bba642b8f8a87fe259c0f136915488bb7a","sha256":"e8aec1f7e7f359ada567ce2510045dfcdae5958cb15cd2910eb6b7fd0694b3d1","sha512":"95f00498f91b06b81eab9eb84c46fc05f86ac94219ebbe54aaff50ab023eae96cf9794f35117a6d59ba9b0a66207764a6fd7f0047caed0114f9f361bf8be1082","ssdeep":"384:1LHg+Xf9nhOG5fjmN087a9wKwrmv1+XT4uOU2yfbSrmCKFZPjcdVHkszMKw0SDWE:Ng+Z8GFjmqny7S1PUzzSdKFJgdVH9E","tlshash":"1ac2e17206b420446a37a7b60dda3f71ca23def58e811f05be6be493ae103509d5e7c6","first_seen":"2026-07-28T16:36:04.356305Z","last_seen":"2026-07-28T16:46:04.172439Z","times_seen":3,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"images.dmca.com/Badges/dmca-badge-w150-5x1-10.png?ID=3db7c25d-c493-4e9d-98ca-7042a9f89e31","fqdn":"images.dmca.com","domain":"dmca.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.985Z","timestamp":1785257103985,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"images.dmca.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Jul 2026 22:04:02 GMT","end":"Sun, 11 Oct 2026 22:04:01 GMT"},"fingerprint":{"sha1":"6A:51:15:F9:1E:02:E4:35:97:2A:18:48:2D:11:45:75:3E:66:46:2F","sha256":"6F:74:D3:86:E0:35:38:B0:3A:FC:F7:85:47:E6:68:5E:32:F6:32:16:56:40:6F:E8:27:E7:B1:AF:3A:99:98:28"}}},"request":{"raw":"GET /Badges/dmca-badge-w150-5x1-10.png?ID=3db7c25d-c493-4e9d-98ca-7042a9f89e31 HTTP/1.1\r\nHost: images.dmca.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/png\r\ncontent-length: 5088\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 1574055\r\ncdn-requestcountrycode: NO\r\ncache-control: public, max-age=31536000\r\netag: \"51f8af3aace6d11:0\"\r\nlast-modified: Mon, 25 Jul 2016 19:39:16 GMT\r\nx-powered-by: ASP.NET\r\ncdn-proxyver: 1.33\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 08/09/2025 14:29:03\r\ncdn-edgestorageid: 830\r\nlink: \u003chttps://dmca-images.azurewebsites.net/Badges/dmca-badge-w150-5x1-10.png\u003e; rel=\"canonical\"\r\ncdn-requestid: ed09acb26890777f99ecb998bf3ccf66\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]},{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":5088,"size_decoded":5778,"mime_type":"image/png","magic":"PNG image data, 150 x 30, 8-bit/color RGBA, interlaced","md5":"4fc4a352d4a5592e9525ef8b60fae804","sha1":"df346a886cfdf827339643cab0122a57af1a3b0b","sha256":"c175377a88f43eee8d84655fa584dd98fd87abbbb608e124e89e62b4e57b28ad","sha512":"0433708b105a571c4a2ec52c9a0eef1b7d809a97eb3c77c1c1d78b4261abf246232fb7e1002e1ae37f7c00268a3db7a8a73bf74c114c7cfb9c1a3883bec35ded","ssdeep":"96:7v7XW5/oJdl4oVdsi/Xr+IiIuBmMvQbG/moa4LaGYeWRRPJt0pcANJ2:7vDWqymdsQXr+7IfMv2G/p9YeaJt2J2","tlshash":"b6a15dc5deae48a189232b0ad672da0ad1f72db72453214d9a1c1a8d6b47944f290b1d","first_seen":"2023-05-09T18:48:52Z","last_seen":"2026-07-28T16:46:04.175578Z","times_seen":427,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/themes/starter-kit/css/main.css?ver=6.11.0","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.921Z","timestamp":1785257103921,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/themes/starter-kit/css/main.css?ver=6.11.0 HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 28 Jul 2026 14:31:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a68bd24-199d4\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":104916,"size_decoded":18416,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65534), with no line terminators","md5":"ab4bd79e6afb398ff171b97946e32d38","sha1":"11e4177a619d45364e96033799e8a25b27746926","sha256":"272276540ccf0459ed8436730087e144584f01cbb498ec2bc2af42345ecbdfa0","sha512":"681f37f117c57faccccfddc3cd39e456434ed8613332f0d1adc3b6129b4f9a4af95788ad154bd39db085230f63090889afb94f9cfe0826834b5ed3712d9164ad","ssdeep":"1536:+1WI4eMHa8aqEB+ENWcuYtcJ3SYiLuVENM6HN26KG3Epi5fG:qgCtm3SYiLoENM6HN26KK5+","tlshash":"60a382c7f1a03518d467c61de0d0babe296f4641e3269eebf4276bb487c92c70952e0d","first_seen":"2026-01-04T17:17:18.931393Z","last_seen":"2026-07-28T16:46:04.173065Z","times_seen":14,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/plugins/site-reviews/assets/styles/default.css?ver=7.2.13","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.922Z","timestamp":1785257103922,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/plugins/site-reviews/assets/styles/default.css?ver=7.2.13 HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 30 Aug 2025 09:32:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68b2c543-7691\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":30353,"size_decoded":6193,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (30348)","md5":"cadcd88c2b50719913dc9399b152246b","sha1":"36d8e2583525e1ea387ef87559eee2d6e6c70bf2","sha256":"9babacb0d4d96f6a146103ec93214179c5f3a5fedb9fd4abd4f69bf023862977","sha512":"fbcb648b7d62af2a6f9c2a062b9415d76464722598dc1557a1092957493c5cc8a7d2e6733968e31456ca6caf883f58c9d0471d71f4bfa0e301535840d3b2deb1","ssdeep":"768:rGNlIy/Z+hHMs6CywLT38RbzwlGyHBjNjgG0W7LwcxmBN1P:aNxZ+hHMs6CywLT38RbzwlGyHBjNjgGC","tlshash":"9fd24358fd38f07c9a13a33bb7d9a3ac101a5c04e9122766a25ba47c47c7db71632f58","first_seen":"2024-12-04T20:32:16.192995Z","last_seen":"2026-07-28T22:02:06.914447Z","times_seen":1776,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/Fat-Pirate-logo-12.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.952Z","timestamp":1785257103952,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/Fat-Pirate-logo-12.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10304\r\nlast-modified: Tue, 07 Jul 2026 09:56:01 GMT\r\netag: \"6a4ccd31-2840\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10304,"size_decoded":10649,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bb3abf1b63b529dacbfbce77141d0713","sha1":"d66d7cd249f048046bc3eec8d7eb37c345e6754d","sha256":"de13940234c35f39dc1a5b48c9123b4869f8df868e4290b255fb6683d48f86ee","sha512":"9454bf9ceae50728a7ce9a828c47a7001815531a84397bde6a5731cf3cc357f378fce1599a511f85536c1e6705c38a139d10b89c79111f3e10150865514a9202","ssdeep":"192:wwT9cKAJo9hSHQf5H4Q+uKTWl9S7gFuIM5fiQdPncQ/nQG3Rq8:wwTTVoGYQkWbSy2piQdvcCQGQ","tlshash":"b322c0f022522da8f203fdbb64ea5340d6ba2427961d37519311fbbf1f079c4249e98a","first_seen":"2025-11-13T03:52:08.194529Z","last_seen":"2026-07-28T16:46:04.17608Z","times_seen":16,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/themes/starter-kit/images/rating/badge-3.svg","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.955Z","timestamp":1785257103955,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/themes/starter-kit/images/rating/badge-3.svg HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 28 Jul 2026 14:31:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a68bd24-5fe\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1534,"size_decoded":1099,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7eeee2de42abcacbff2a6c7bf5a657cc","sha1":"51a3fb1504d7b7e0e33aa5726eeb44afc3bb71d5","sha256":"27c33f3c5feaa8d2e46c4825da890fdc4c413b92c15832715497f617668f9ac6","sha512":"1be718acc70ef82173c17393f61186cb71ef7ad5cbcc77e479846d73c067063e7b9eff8239cfe111b3828655f3f966170677a6e998bc1a8f5d2335a1087ff559","ssdeep":"","tlshash":"5631877ea20d2d7af12885bc9e12d479147abcf74cc3000145e1f9a7d4a60c61cfae9b","first_seen":"2025-06-05T18:04:56.837162Z","last_seen":"2026-07-28T17:12:01.695408Z","times_seen":62,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/Logo-Playfina.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.968Z","timestamp":1785257103968,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/Logo-Playfina.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 36516\r\nlast-modified: Tue, 07 Jul 2026 09:56:03 GMT\r\netag: \"6a4ccd33-8ea4\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36516,"size_decoded":36861,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"78d693c5ffcb8938f9d786a438c637a1","sha1":"cbab5f0e49f47e88cbcf3e0e929dfe9375c7ca11","sha256":"159396cb290ee45165cbaa7d8d0d691d22e090f6c56ae107106ec4589af3f15f","sha512":"606109185e43a415dd6bc365a8fbb1cf975436ecd6a119ffb108c18bd4bd6b5025f1ab21568df69f2202c0519f327cd4f15210ce8ccba4a47b5aea8103d97021","ssdeep":"768:VTNOoMmLx7Qh5c2P8lV8/ST7KBLuuyWn/6pBGdCF0SJWgv:3nzx7Qh5c6+8/ST7uuuy4ypwu4w","tlshash":"b6f2e09b6316770aef789b7c7ec2ea53702b79109ef85aa3d07084a329981c69495c84","first_seen":"2026-06-22T07:10:50.512438Z","last_seen":"2026-07-28T16:46:04.165577Z","times_seen":10,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-app-android-apk.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.974Z","timestamp":1785257103974,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-app-android-apk.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 55706\r\nlast-modified: Tue, 07 Jul 2026 12:35:17 GMT\r\netag: \"6a4cf285-d99a\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":55706,"size_decoded":56051,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b88c950ad180f7602dbc22440810dfae","sha1":"08d3169e39aa2076d1ad535f4a0423faa012798b","sha256":"1c4b64663a0d969bd6f70f08a8179a0e51e43b2848597a634a8678d0370bb079","sha512":"15973b790b40291b15637676c160729077c79d9e15c7e008c0a14c36f97d136e08a9230da6ee5255d17c0d637849cba23bedb959781eca716f328379a3d697bb","ssdeep":"1536:hQGuLYXFPMkQcEtN8D9qqfgx4XxK5CgKZ19G:hQGuLYVP1QcEtS+4ukG","tlshash":"da4302ca446adcd3d58253535dc9618d386faeac1429c8e4e53083182d7fd3f2d4b8ea","first_seen":"2026-07-28T16:36:04.362605Z","last_seen":"2026-07-28T16:46:04.184219Z","times_seen":3,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-sports.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.982Z","timestamp":1785257103982,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-sports.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 59774\r\nlast-modified: Tue, 07 Jul 2026 12:53:36 GMT\r\netag: \"6a4cf6d0-e97e\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":59774,"size_decoded":60119,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a7c0911d644d7bbb5fde14a0377408ce","sha1":"86a92b062dafe6b3b9b8701212a760c8ad7e93f3","sha256":"c5fc7614cc8e6c8b4f57bea31034c3c09a2602f27e1ae318a77e5adc8f4b08cc","sha512":"f828b25049906752fc024b063dc2e0ef310c1f041e88748e3b1e63daa0b2f52c59714e82a2e5ec7dda24095e613c8877f82c1f98524f482351ccdca0de7089d7","ssdeep":"1536:/HqUtj6iMxknb3KNmh6fYX/GPHStsHisM93EDYZb:/BCiQ6/GPySHiPSDYV","tlshash":"674302537c8d92c19a7875685d5806a32a006fbbf5c216bc637b0437acd0d63db4aedc","first_seen":"2026-07-28T16:36:04.33333Z","last_seen":"2026-07-28T16:46:04.186347Z","times_seen":3,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.1","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.918Z","timestamp":1785257103918,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.1 HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 30 Aug 2025 09:32:37 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68b2c535-b83\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2947,"size_decoded":1377,"mime_type":"text/css","magic":"ASCII text","md5":"64ac31699f5326cb3c76122498b76f66","sha1":"cc0a5a1741b8257001f89b331378d8aa7c30094a","sha256":"4048fd0e6c44412465449ba4f5c7272349ee1574401cec755d6b8d9c0ccc28dd","sha512":"23ad865e63544ee039221161083510346b01b8be56fa7a83540036c51dceb3f0171adf8f932cf77a457240427c0c3ccbad1f9f371e977c5b6a01e9fe316a878f","ssdeep":"","tlshash":"d0510164660028504bff92db6ea9db047b6e7481cd1faf97b0c21a7c5b782851223e5e","first_seen":"2025-06-26T12:36:15.124007Z","last_seen":"2026-07-29T03:16:06.430109Z","times_seen":138188,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/Goldex-Casino-Logo.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.962Z","timestamp":1785257103962,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/Goldex-Casino-Logo.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10772\r\nlast-modified: Tue, 07 Jul 2026 09:56:02 GMT\r\netag: \"6a4ccd32-2a14\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10772,"size_decoded":11117,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9b743c8b52d59a4896ed4a107b8464a5","sha1":"3c377e02290e1c945fe95683c6c48a30e9133af0","sha256":"3f6459adc35f31999790a201dbac78ccb7e39be24e50e3b903c0e1757ed6f995","sha512":"f8c1a06382479a20b21bafa7ac56d0a931e35372ec915d63195edabd161310b5de2b284ea2e879d256f63446033b10285caf2573948cdd17c481cae6444c986c","ssdeep":"192:QwTCf/R1TjpVlxSLqYUGYrcXrpbyC+oaAn/k1WL7bqVItIuPxwEmmc:QwTCnR1vpVqG5GYrcXrEhAM1XmtImwE4","tlshash":"2a22bff052338ab5ed435134a0e27bc4a0eff51c4fadcfa6874507032e66961969379e","first_seen":"2026-07-08T11:54:42.219485Z","last_seen":"2026-07-28T16:46:04.189241Z","times_seen":9,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/lukki-casino-8.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.966Z","timestamp":1785257103966,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/lukki-casino-8.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4418\r\nlast-modified: Tue, 07 Jul 2026 09:56:03 GMT\r\netag: \"6a4ccd33-1142\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4418,"size_decoded":4762,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d01b3e09ac6a68bf4ddd5088eeece361","sha1":"bc6eb050ea932e43f3c03c6dde7a584b9545b7b5","sha256":"d9db133b5472ada60b4553b9b14628cbb581b4aa8d9040806980bf3e74e47cdd","sha512":"d5024135988eb1fe6d7343af4b185a87a3bdccdec270cdb5c02be82dd856bcb9db604ea4e2d70131e6381ed321d99905a9c27909e6c4b5d92d4302d9a6314db2","ssdeep":"96:TElbw+iXtIRGmci3vpvaJmkrL9Bu1ROoSD86pOvBVeKlginBdCrbFzN:OwTCUmci/BaJ1XSFVFLBYPf","tlshash":"05915d1e97a6d382eb216ffce1902356a3157d31c2857d3145e9672b8300ee42f59e2b","first_seen":"2025-11-13T03:52:08.129441Z","last_seen":"2026-07-28T16:46:04.175088Z","times_seen":15,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-casino-games-providers.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.971Z","timestamp":1785257103971,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-casino-games-providers.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 59170\r\nlast-modified: Tue, 07 Jul 2026 12:35:19 GMT\r\netag: \"6a4cf287-e722\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":59170,"size_decoded":59515,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8d6c0777bc7f254a14dbd79533e5e4a9","sha1":"ae2c10464cf5d3b84353f98f3962cf7b2178cdd5","sha256":"4cd6bfd6d9da914896cc42c68a44c376644b622ac10058420456733cd0cb2e1c","sha512":"70b1a1b3c689290dd5353e450783f339ee73e51e78d34fdf8a09397b0234757ed57cdecbbe6fb47d2c0ec58bf4caa37fc58e13ed3c95526ab38822a21ac27d2c","ssdeep":"1536://a1gjrnPaX4eJVdyOfI92OatJ6R81z5Mfp66n:XaujDSXfA9/U6R8on","tlshash":"fd43022cd2bdb253cfa91ef716738cefa71905c063f265531cb0a6f2489d29ab311990","first_seen":"2026-07-28T16:36:04.340349Z","last_seen":"2026-07-28T16:46:04.178886Z","times_seen":3,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-homepage.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.984Z","timestamp":1785257103984,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-homepage.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 64956\r\nlast-modified: Tue, 07 Jul 2026 12:53:37 GMT\r\netag: \"6a4cf6d1-fdbc\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":64956,"size_decoded":65301,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"87fba1211511496445a0678e8d00c44b","sha1":"c6152b7e96d1c3d85d8cfe82505d2b3c54b76a41","sha256":"1a4b661b36a06a8df887535542b0a14b163cc1a38c93c4434e35ec0c6e991227","sha512":"104c11be97719ab24fbece00ac82213f1b29cb08005928743223ffb01760fef494aa43c9e6efeb89df022f04424d3a0a24145ab9d45412856747748024a784f0","ssdeep":"1536:9q9n12rjWRMXL1xE9iwrNlr7+bVY3LMHQi:QsCq709f1+BY3LqJ","tlshash":"da5302a264f21b2786ae7b741ef02a30ffc3545e5e56e1e8b9b454f70600d428d6326b","first_seen":"2026-07-28T16:36:04.365964Z","last_seen":"2026-07-28T16:46:04.177206Z","times_seen":3,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=1784896351","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.944Z","timestamp":1785257103944,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=1784896351 HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 24 Jul 2026 12:32:31 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a635b5f-b1b4\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":45492,"size_decoded":12260,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (45492), with no line terminators","md5":"8410163bf0c8c06654596933cc416ddf","sha1":"759865864b0623c382ff1a2c26a10efcd0125a70","sha256":"459822d33dd9667eb24b4e47156f05cd9276d5aeafcb1131c5a32f4c29a634a7","sha512":"2ea09bee476836c1458439a989e9a2013202965068c0f98496d797ab30a29fbba7b5bbab0faa4c658a34945da104cd7fd8bbd6be473d3fa4ac4e68de5ad5e031","ssdeep":"768:lW94cj/g8aGSJjv+lfzwLpstNIuWBxumxesKNVhIkYJO2ybEXoHVFnvhY/I+1URx:38aMSBchY/IlUCHC59KmmDECTr","tlshash":"8b13eab93e9cd0b516ee47ed37abab48f4303562d80f88509465dc542268dc60f9bfb1","first_seen":"2026-07-23T20:34:07.462598Z","last_seen":"2026-07-29T02:58:16.493757Z","times_seen":115,"resource_available":true,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/lucky-hanter-1-1-7.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.967Z","timestamp":1785257103967,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/lucky-hanter-1-1-7.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8428\r\nlast-modified: Tue, 07 Jul 2026 09:56:03 GMT\r\netag: \"6a4ccd33-20ec\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8428,"size_decoded":8772,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"500497469fc4d9c8535196fbcc740b05","sha1":"354360f6ddbe55afc69f59e694de47d9ea88fcc1","sha256":"a1130edc12b108309f078b239cf9edaf461ab0dbe162323bfa31721218194d7a","sha512":"31b94c02fd24cec0c61e530db7036a52a4c3942847548355977e3f56923661d6003b8423574f19d698c621f6b9d7f4bc73af7b032ec53d5e6f76da963f1e5e6a","ssdeep":"192:NwTJLik8H9zUQ1K0oTatnYrJVphEzOph0ldaT:NwTJv8obQcJV4zldaT","tlshash":"0f02ae092bb60dafe490517d5e69cfd2958841a6c2de3f9903cecb26716ea441c4a273","first_seen":"2025-11-13T03:52:08.173283Z","last_seen":"2026-07-28T16:46:04.17352Z","times_seen":11,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-ninjas-in-pyjamas-1024x522.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.976Z","timestamp":1785257103976,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-ninjas-in-pyjamas-1024x522.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 31232\r\nlast-modified: Wed, 08 Jul 2026 12:15:17 GMT\r\netag: \"6a4e3f55-7a00\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31232,"size_decoded":31577,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"738a295a2c0cdaf28ff51544673f7464","sha1":"d001f674dea5f6bedd1f8a277feb51eea11de868","sha256":"f93b8da08becf8134c33f30c78a34b78f509907c99f02d8dbd4cbacaf5512331","sha512":"300522878d1ce08d718e4f1b3bcfea9913645ae906a0ba8755705f88f6d2268b392d3faff68cf195f043ba715f369f5fbf06a83ba6eb5e34307aa44c36672240","ssdeep":"768:LTGAtQItQ19aH3uyZuZnw8rs32RoVxrFrzq7N:mZItQ10XxanPsm2xh8","tlshash":"cfe2e11932155a7ef500543cc6b30f23a77d9a7a98b92e30614673d0853c0efb7be9a9","first_seen":"2026-07-28T16:36:04.354392Z","last_seen":"2026-07-28T16:46:04.185761Z","times_seen":3,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/complianz/css/banner-1-optout.css?ver=1784896563","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.923Z","timestamp":1785257103923,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/complianz/css/banner-1-optout.css?ver=1784896563 HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 24 Jul 2026 12:36:03 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a635c33-451b\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17691,"size_decoded":3548,"mime_type":"text/css","magic":"ASCII text, with very long lines (17691), with no line terminators","md5":"d083af350e88bdea63bf744bdf3b1f7e","sha1":"b5503855080aaef6bdee1dd04547a727604b1f98","sha256":"ea96256a5a93207ea15cac3a10f86aac2970d9a463ff03d4625ac3901c43d681","sha512":"8e6b576fe8498c89174ecaa2161b9de6122d7e80a3bd80b4ef66c763df81d04d03af331866fc7483c37483d3f4be922c38aa186bcbf3266b921a22fafa880322","ssdeep":"96:su9p5Jbne6nSZ1csUi5pKkvqlIWurBnq/Dey/+Ng1cFkT7budlYLhf8IqT8sqlyA:fuDWDi5D2IWlrLPWGneZ3sMBg","tlshash":"a88230ad9e0c1164d2dedf1d3bab9a0e9114f331b29d1af824a17860f2ee5d11d2d387","first_seen":"2026-07-28T16:36:04.334819Z","last_seen":"2026-07-28T16:46:04.189744Z","times_seen":3,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/themes/starter-kit/images/rating/badge-2.svg","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.953Z","timestamp":1785257103953,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/themes/starter-kit/images/rating/badge-2.svg HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 28 Jul 2026 14:31:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a68bd24-5fe\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1534,"size_decoded":1098,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4a307288943507758d275c24d44b7b8f","sha1":"d448cc20c31b50f716eda30aa040806c162aad94","sha256":"34dc3a35cfb7de60205d9b47f253ae9869f2b590c7cd8a5781af35d1f9b368a7","sha512":"b9df3f2005c9cec2ccfeb85fd04e037e3bbe801d39c7e82da29da3fbf8e7368d789f690ee0dedc474dbf1b1d557d0f13ae14ace045c14b3afcd92efe8a8f03aa","ssdeep":"","tlshash":"0931927ee10d2d2af13886bc9e12c478057abcfa0cc2100045e1b9a7d0a20c60ceae9b","first_seen":"2025-06-05T18:04:56.833392Z","last_seen":"2026-07-28T17:12:01.689004Z","times_seen":68,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/0x0__28_-removebg-preview.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.957Z","timestamp":1785257103957,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/0x0__28_-removebg-preview.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 15200\r\nlast-modified: Tue, 07 Jul 2026 09:56:02 GMT\r\netag: \"6a4ccd32-3b60\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15200,"size_decoded":15545,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"70a29908cb688d388f9d676f2df3005a","sha1":"08fd835f8877b50dfa0bf86c7c7289bf80bceb19","sha256":"e5387df49b389f37e9edeb9f2ad57bf1a905bde34505abd4b53abe7484104207","sha512":"5e8b9b2aaf1e4add5ab7d7fd51938b68f06bedbcc2fb14e60ab325e939b7ceb515d979ab18de9e276618df0be209cb4408b775264c1c0cb74d7da5acd852abaf","ssdeep":"384:VwT6fMoelWQoVm1B91IqkeutDRdzIww132gLcpznBGrJOov:KT6cWQoIWeMDzTw1voBOOo","tlshash":"f962d162361e5d30f093797ab2c3716f2329dd21a3794780624e54ef1bc8de20e885f8","first_seen":"2026-07-03T10:53:35.712019Z","last_seen":"2026-07-28T16:46:04.193161Z","times_seen":13,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/Gransino-casino_logo-13.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.964Z","timestamp":1785257103964,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/Gransino-casino_logo-13.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11764\r\nlast-modified: Tue, 07 Jul 2026 09:56:02 GMT\r\netag: \"6a4ccd32-2df4\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11764,"size_decoded":12109,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2de4423a831842a22de1885b71e228ab","sha1":"c9bed5a72e642a86a69087fd150cb6db0c0135cd","sha256":"457a0926d55c930b17bd92fe88049283a2f53f8b39136fcb5fbbcb23a0b8b176","sha512":"7ded7a6382ed74a24188b344dce13e47e154d4faecba1376498af60ddb1b4f84cd2a77214664807eff4639e1e6c0d9d8c75a252956611ecaf1ba88574abcb71d","ssdeep":"192:HwT88rZHYe3PDSIhmR/VSRVOUSsPvpGftFGIfX+6xGhZ1xASU2:HwTNF4e3mIa/nUtPvcfbGIW66D","tlshash":"0b32c057f730ca4ccb0943331d559f849b2a2d366227cddd9894e8d325173e8ae6aa33","first_seen":"2025-11-13T03:52:08.138651Z","last_seen":"2026-07-28T16:46:04.164577Z","times_seen":17,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-login-guide.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.974Z","timestamp":1785257103974,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-login-guide.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 45742\r\nlast-modified: Tue, 07 Jul 2026 12:35:20 GMT\r\netag: \"6a4cf288-b2ae\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":45742,"size_decoded":46087,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c0e7c81459ef04bbb7158dd3d3591571","sha1":"bdec7ba67550939c81c6ed8744df89ee87277ba4","sha256":"2542cd26f7470727bd7a2aaad73686b5dc6bfb080e4ce4090af743126db9ead3","sha512":"c8453623efc465cc0e18593907a59bd5148f01d040e1bd3995ac2c4fe4db97cba425d46faa9ba2414220b9782f690ad543f8294cfb2a2e8ea2250ff4e2d6deb3","ssdeep":"768:syik6MKhwKEdRbZnN52xvA5FvDDdEd6L0QUXsR1FU21FY2cjn7pT5XZFU:sqPocZnN5nv/GMAQUXsrFUKeLj7pT5X8","tlshash":"6323f2620eec8db5024f831196784958163b386af737fd2878318f95e2b931fb542c6b","first_seen":"2026-07-28T16:36:04.330034Z","last_seen":"2026-07-28T16:46:04.176589Z","times_seen":3,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-user-safety-account.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.978Z","timestamp":1785257103978,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-user-safety-account.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 53148\r\nlast-modified: Tue, 07 Jul 2026 12:35:16 GMT\r\netag: \"6a4cf284-cf9c\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":53148,"size_decoded":53493,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"704f56ae946960480219aa96a378355c","sha1":"f27bca441ac05343594f11f9e00daf1f48d5c600","sha256":"3e04ddeab84429488c1f58b02c8276b9cd7088f99d75a3be13d51ad58099287d","sha512":"144332d2a47d1e9bfd903e6968a5cdaa15cb33f290d2cfec061397dfb3c76c465bbed8abe30afa32b65689a33a972524671df8d761471eb5d007ba71ab6b72c8","ssdeep":"768:lxc6jii22CdzrciEftk0np8EHq0WEYQRUAI/xW7l65uZdl7mcJphMPnlEnp:laxjdz4iEftkS8EHjWJAIil65eEaTcGp","tlshash":"b93302520e21348ff1678b72e8e8f731a38053f526745abe6e48e9426af22df205547d","first_seen":"2026-07-28T16:36:04.368356Z","last_seen":"2026-07-28T16:46:04.171797Z","times_seen":3,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/plugins/site-reviews/assets/scripts/site-reviews.js?ver=7.2.13","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.943Z","timestamp":1785257103943,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/plugins/site-reviews/assets/scripts/site-reviews.js?ver=7.2.13 HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Sat, 30 Aug 2025 09:32:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68b2c543-a660\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":42592,"size_decoded":13472,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (42591)","md5":"966eee900d7086888c6bd24e345ef1ac","sha1":"491665f686c464cd80b35807c865dd9ba9586c44","sha256":"bc595c8641415c3d16715855939a7a0edfc323acca2a3c6869effa7548e05156","sha512":"5d7152d312ca977277ad81dc638c392fe60616e426dd3867bce3d001dfb541689374d17ce16d39ea3a126ff84b1e2059ec8c028afde62a69481988846792dfa1","ssdeep":"768:Z1m1pnPP6/DE5wVrjS/zP1bjV9YIt9+scklUzJNw6KtC3p/8kUr7W35L9XIa5zQa:LDESVre/zP1vV95t9SWgLt27W35LP5zH","tlshash":"7a13d9967356b4330aea41f6a0365382b332618c7805805cf478ecee1e69d8a7777f76","first_seen":"2025-03-01T11:52:27.461641Z","last_seen":"2026-07-28T22:02:06.942974Z","times_seen":2022,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/themes/starter-kit/images/rating/badge-4.svg","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.957Z","timestamp":1785257103957,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/themes/starter-kit/images/rating/badge-4.svg HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 28 Jul 2026 14:31:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a68bd24-5fe\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1534,"size_decoded":1094,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"da49c60a038c21ad060f0b53ff910426","sha1":"174fdc729062994bb104f00c9c6072a0cf4faccc","sha256":"addd89150ca262be3c0335ee993d4559fb1d5ce30ac6c25c6c3bdccb7c49e9c5","sha512":"38a85e0737612e812633a5b3f7f66a8bd9609ff6d24011b479ad55027f61373b54cecb7750d75d45fd2765931456920866eeafde617bc6e6d018cdc206d072ab","ssdeep":"","tlshash":"cd31957ee10d2c2af12885bcae52d478047abdfb4cc2000044e1b9abd0a24c60cebe5b","first_seen":"2025-06-05T18:04:56.85468Z","last_seen":"2026-07-28T17:12:01.700502Z","times_seen":40,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/rainbet-originals-in-house-games.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.972Z","timestamp":1785257103972,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet-originals-in-house-games.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: image/webp\r\ncontent-length: 58044\r\nlast-modified: Tue, 07 Jul 2026 12:35:15 GMT\r\netag: \"6a4cf283-e2bc\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58044,"size_decoded":58389,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"38dde41c2ea65ee3e3b54f871e1cb6b7","sha1":"3ef920b307f8702a46c8aa24b76548d9ad703c2f","sha256":"52a707afcf9540fd40bab3fb8ffa8166665f0b767384de30e6ef9b3377f337f8","sha512":"90cbbc3a3258e6b4410c86461d4f468f4844e2e69b23ae2fcc4f7017558cd2e302bd4eee645decfde48400bdd28c2bb3556cf6cbd9c76d19e9f090bc91bc7051","ssdeep":"1536:OyMXsDMjrTls5/atGk5+l2njmmy44pu2DmL9aco:OyI/Tls5CtGNQmL44Zqhlo","tlshash":"1643f22d4db6e2a685f0017935c42088d662da19627bf0ae80e674ee2ff1b4dc53f91d","first_seen":"2026-07-28T16:36:04.328761Z","last_seen":"2026-07-28T16:46:04.174051Z","times_seen":3,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:04.212Z","timestamp":1785257104212,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rainbets.vip\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 62460\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 22 Jul 2026 13:11:12 GMT\r\nexpires: Thu, 22 Jul 2027 13:11:12 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 10 Sep 2025 16:30:17 GMT\r\ncontent-type: font/woff2\r\nage: 531232\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":62460,"size_decoded":63273,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 62460, version 1.0","md5":"4c04ee82dc1deb4f32b244195d258e9b","sha1":"9bd2bc9c6f54075acd20589f87c17a73e3ab07b3","sha256":"ab72fd10c9ac5633c1f9ae4267864b674596062e023458e02973080bd1098904","sha512":"43bd417c75382fbcad7a44c73db7ec8e883bb505b63215ec67488eb205b61acd94031d5740bdf70cf413fcb126ac6a567b4c71831eeb063e5643fa0adc704895","ssdeep":"1536:Hjv9lkTtdw0aS3yPvWdfDSFdW6KK8zPJ86DQMBXQX:Hz9ceS3y2FDSFdRKNzPJj5gX","tlshash":"8753028264d3489c8c8b69d354847f1c707ef88fc1b88995a8e33ca14d4b1e6e85ad7f","first_seen":"2025-09-11T19:26:36.805532Z","last_seen":"2026-07-29T01:19:49.687542Z","times_seen":23641,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":34,"receive":36,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.1","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.940Z","timestamp":1785257103940,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.1 HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Sat, 30 Aug 2025 09:32:37 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68b2c535-348c\"\r\nexpires: Thu, 27 Aug 2026 16:45:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13452,"size_decoded":4641,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (13452), with no line terminators","md5":"2912c657d0592cc532dff73d0d2ce7bb","sha1":"70a679e2769825236f83bcc56965a9d0bd86c4e9","sha256":"ddcce687729cb358abf9d0d8e1217a097859be2b0d18c23d7c851b38c87bc9c0","sha512":"9646384e65d09bf00cb20365f43e06dd41e7428e3fc6cc2737f4e69b50f006ebb25bd24a566fcd9faec2f0dcb24404e25d57ba7b8c6aba61797a29c515ad5144","ssdeep":"384:IsIRHeFJ1yQ7QdfnJgeYh7MXlsNqrBp1pgQpwOjNtqohIQ/5Z:IsIR+L1yQ7QdpYh7M1iqrBp1pgQpwOjn","tlshash":"0a52d7a1472955321eb506e391e513c1769075aef44b8aa1a898dc2e18bdcc328f3ff7","first_seen":"2024-11-04T17:50:00.022634Z","last_seen":"2026-07-29T03:16:06.426577Z","times_seen":228733,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"images.dmca.com/Badges/DMCABadgeHelper.min.js","fqdn":"images.dmca.com","domain":"dmca.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:03.935Z","timestamp":1785257103935,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"images.dmca.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Jul 2026 22:04:02 GMT","end":"Sun, 11 Oct 2026 22:04:01 GMT"},"fingerprint":{"sha1":"6A:51:15:F9:1E:02:E4:35:97:2A:18:48:2D:11:45:75:3E:66:46:2F","sha256":"6F:74:D3:86:E0:35:38:B0:3A:FC:F7:85:47:E6:68:5E:32:F6:32:16:56:40:6F:E8:27:E7:B1:AF:3A:99:98:28"}}},"request":{"raw":"GET /Badges/DMCABadgeHelper.min.js HTTP/1.1\r\nHost: images.dmca.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 28 Jul 2026 16:45:03 GMT\r\ncontent-type: application/javascript\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 1574055\r\ncdn-requestcountrycode: NO\r\nvary: Accept-Encoding\r\ncache-control: public, max-age=31536000\r\ncontent-encoding: zstd\r\netag: \"26b181f16d28d51:0\"\r\nlast-modified: Fri, 21 Jun 2019 20:14:34 GMT\r\nx-powered-by: ASP.NET\r\ncdn-proxyver: 1.33\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 08/09/2025 14:29:04\r\ncdn-edgestorageid: 830\r\nlink: \u003chttps://dmca-images.azurewebsites.net/Badges/DMCABadgeHelper.min.js\u003e; rel=\"canonical\"\r\ncdn-requestid: 1cc4427d859150c366228b66ea94214c\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":465,"size_decoded":991,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"bac6fb686027b93b6565e1b1e5e8e213","sha1":"e585bdd95488444f0ce2888d8281dbdaf73ca2ea","sha256":"e8021f1a9dad409f7e699457ac334653bf800464df69900237c4de1c29e275d0","sha512":"adee788b03089ef933d40b72a9ffe69742f4873788de6f20ebed6b2abc07895ff8f4b176a6bbfaee231ad27f479bad94e269b14cefdc569ece7e3d8dd9be8500","ssdeep":"","tlshash":"21f0aba88be2043e1d43f470593da74128b6406b300ecc01fd0cd6984f84b7913be9ed","first_seen":"2023-03-07T01:02:48Z","last_seen":"2026-07-29T02:19:08.910514Z","times_seen":16833,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":14,"connect":9,"send":0,"wait":2,"receive":-1,"ssl":5},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:04.211Z","timestamp":1785257104211,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rainbets.vip\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 62460\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 22 Jul 2026 13:11:12 GMT\r\nexpires: Thu, 22 Jul 2027 13:11:12 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 10 Sep 2025 16:30:17 GMT\r\ncontent-type: font/woff2\r\nage: 531232\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":62460,"size_decoded":63273,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 62460, version 1.0","md5":"4c04ee82dc1deb4f32b244195d258e9b","sha1":"9bd2bc9c6f54075acd20589f87c17a73e3ab07b3","sha256":"ab72fd10c9ac5633c1f9ae4267864b674596062e023458e02973080bd1098904","sha512":"43bd417c75382fbcad7a44c73db7ec8e883bb505b63215ec67488eb205b61acd94031d5740bdf70cf413fcb126ac6a567b4c71831eeb063e5643fa0adc704895","ssdeep":"1536:Hjv9lkTtdw0aS3yPvWdfDSFdW6KK8zPJ86DQMBXQX:Hz9ceS3y2FDSFdRKNzPJj5gX","tlshash":"8753028264d3489c8c8b69d354847f1c707ef88fc1b88995a8e33ca14d4b1e6e85ad7f","first_seen":"2025-09-11T19:26:36.805532Z","last_seen":"2026-07-29T01:19:49.687542Z","times_seen":23641,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":32,"send":0,"wait":19,"receive":50,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbets.vip/wp-content/uploads/2026/07/Rainbet-150x150.webp","fqdn":"rainbets.vip","domain":"rainbets.vip","tld":"vip"},"ip":{"addr":"183.81.169.24","port":443,"asn":206264,"as":"Amarutu Technology Ltd","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbets.vip/","date":"2026-07-28T16:45:04.324Z","timestamp":1785257104324,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbets.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Jul 2026 13:55:54 GMT","end":"Mon, 26 Oct 2026 13:55:53 GMT"},"fingerprint":{"sha1":"5F:62:4F:9B:59:43:8E:4A:8A:2F:8C:94:C9:96:54:91:F9:C3:92:10","sha256":"8B:47:AA:7A:63:0B:B6:B3:FB:7C:B2:72:78:0F:C7:2F:E8:AE:98:88:A9:13:A4:CF:83:76:A4:1A:AA:DF:32:32"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/Rainbet-150x150.webp HTTP/1.1\r\nHost: rainbets.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbets.vip/\r\nCookie: p2_popup_unique_name=GVgRBVsdH0pWHVAI\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 16:45:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2312\r\nlast-modified: Wed, 01 Jul 2026 10:16:06 GMT\r\netag: \"6a44e8e6-908\"\r\nexpires: Thu, 27 Aug 2026 16:45:04 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2312,"size_decoded":2655,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"476299f93477131302031e6c0bf0343b","sha1":"af0249a5080aeb9a322c83c8cf31362f7c0b117a","sha256":"2b24113f1eeea26c808d22c9c3e0c5847eaed8ed22939352a356151c6db2e31c","sha512":"caf785b87261cd2be14cf20b7c3f01b86eed13fc5adab68b6e3b97d0d1d8bb9b6f869558b822b3dbb9aa6de235dbbb13f3ba4c4a2ae5b4aafdcbd443ec91950d","ssdeep":"","tlshash":"f1414d2471bc8b75c5e0ad77fde455e050c465bd6401cd970aab083d29df3652a24fa3","first_seen":"2026-07-28T16:36:04.327837Z","last_seen":"2026-07-28T16:46:04.194322Z","times_seen":3,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"rainbets.vip","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}