{"report_id":"98d2ccf6-1f08-4ae1-8083-e022dc862229","version":0,"status":"done","tags":[],"date":"2026-08-22T08:07:44Z","url":{"schema":"http","addr":"rainbetwin.com/","fqdn":"rainbetwin.com","domain":"rainbetwin.com","tld":"com"},"ip":{"addr":"104.21.93.4","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"title":"RainBet™ Sweden – Officiell Krypto \u0026 Sportsbook 2026","dom":{"size":272947,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5096)","md5":"718ab99cfd51ee339e6fe0b5780509ec","sha1":"43b51c5fbd95598c736114b710e74df48275416f","sha256":"e2896216da188e3a05c4415589f2c1d6fd8aba2b2a5ba5f51fa242b302365b5d","sha512":"c1224f3d9dced8c22fc0c96d18152f1158312379929581de35ced1a4de0c17fe8069ad6cd9500ba16994963390187e5e3497089c998797e183e44567ed9bd6a3","ssdeep":"3072:iUcOQ27oz8ADpUlgycwsRChgGBOl9jzk7q8o:iJ27lADpUl2Hp","tlshash":"2444f96b46a72459392b727c9fa6270d226d8007cb15cdf4badec148cfc9a94c8f274d","dom_hash":"domhash3daf3ee5d7ed90bad33c54c7280fc888","first_seen":"2026-08-22T08:07:18.301919Z","last_seen":"2026-08-22T08:07:46.99528Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rainbetwin.com/","fqdn":"rainbetwin.com","domain":"rainbetwin.com","tld":"com"},"ip":{"addr":"104.21.93.4","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-26T08:07:44Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"g10102301085.co","ip":{"addr":"34.120.31.228","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2020-07-22","domain_rank":72137,"first_seen":"2021-08-03T12:42:57Z","last_seen":"2026-08-22T08:06:27.989901Z","alert_count":0,"request_count":1,"received_data":779,"sent_data":522,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}]},{"fqdn":"rainbetlegit.com","ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"domain_registered":"2026-07-03","domain_rank":0,"first_seen":"2026-07-22T10:08:02.494315Z","last_seen":"2026-08-22T08:07:16.70559Z","alert_count":104,"request_count":52,"received_data":1913334,"sent_data":28007,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"Complianz","description":"Complianz is a GDPR/CCPA Cookie Consent plugin that supports GDPR, DSGVO, CCPA and PIPEDA with a conditional Cookie Notice and customized Cookie Policy based on the results of the built-in Cookie Scan.","website":"https://complianz.io","common_platform_enumeration":"","icon":"Complianz.png","categories":["A/B Testing","Cookie compliance","WordPress plugins"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Yoast SEO:25.9","description":"Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.","website":"https://yoast.com/wordpress/plugins/seo/","common_platform_enumeration":"","icon":"Yoast SEO.png","categories":["SEO","WordPress plugins"]},{"name":"Contact Form 7","description":"Contact Form 7 is an WordPress plugin which can manage multiple contact forms. The form supports Ajax-powered submitting, CAPTCHA, Akismet spam filtering.","website":"https://contactform7.com","common_platform_enumeration":"","icon":"Contact Form 7.png","categories":["WordPress plugins","Form builders"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-08-16T22:46:07.924415Z","alert_count":0,"request_count":1,"received_data":60302,"sent_data":526,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"rainbetwin.com","ip":{"addr":"104.21.93.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-10-29","domain_rank":0,"first_seen":"2026-07-28T16:30:18.865055Z","last_seen":"2026-08-22T08:07:16.687113Z","alert_count":0,"request_count":1,"received_data":754,"sent_data":483,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rainbetlegit.com/cmplz-cookiebanner-js-extra","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"0c4480ae501dccf5296f23ab107dd6d4","sha1":"96028cfdaed81fab291e7c24c14e0a10fcbc9958","sha256":"938a038c57299bd621010be0c1c40a2b9ac0bedfe3634f57fa0b11f7e17f3e00","sha512":"c2ae9a19eb908ed4260544fe7afa9cdaa0ab0d25597f2be9bd8de46e6a8283c42fe4e0734ee903df4eda1649e3b151eb5b5f0de3a368520dd5f2dad4e041ba31","ssdeep":"24:3RWNe+Xqyf+6GGaDeyQgiPqRKM9iAwYS8cAGFxEe3A3VO2:3RWOAeGBPPqRHPUFSnVO2","tlshash":"11e19b3bfe7c84b946c463b81694484f92dc5191d2a98558e145ec28817c36bafe8607","size":7350,"data":"","first_seen":"2026-08-22T08:07:18.425119Z","last_seen":"2026-08-22T08:07:47.042916Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"2e88a401907300a9989966839f7ab52d","sha1":"c15dcbe7b4ab3c929d4caa40438bbd384babcf11","sha256":"1320fe8c1f2515e760ba2b7347b1c6b4ad4f1f81e268099beb8b0b9e30cb9794","sha512":"49c9fc5c37a593f329bb646f7a7b53407fe1a05f5e43d91e0adecec646734c22a0bc32b0bb69ac87108a379fca06a89a18c0f5c208dce06471aa8cedf7a8ebb9","ssdeep":"","tlshash":"dd01abc9b9d17914259f616c21ab611e7573b5013e0c0ef3d46556922e30686d23e1ce","size":829,"data":"","first_seen":"2026-07-08T11:52:31.647944Z","last_seen":"2026-08-22T08:07:47.044552Z","times_seen":26,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"3b4197ca8961c6575d40cd85e5248895","sha1":"d595e0575675670719a91903faa70b36fbbacad5","sha256":"8df316ee2087bd1ebd549fadcd0b69e6e0d58e0b3a5113d0fa54145ee049eaa4","sha512":"701bcf3714a53dcf3bee56f4fdab4c97cecb65d38652f6f447df7aa533ac6fa93684bf7aaec19a8ac5d8a469bbba4e9cee95b904c2f36d557dcdd2178b4d60f5","ssdeep":"","tlshash":"72e012bda9e154f0026bb1191a6fd620297204c7a4c49e047e5c4e5d1fa445c97e1a55","size":346,"data":"","first_seen":"2026-06-07T17:05:58.283171Z","last_seen":"2026-08-22T08:07:47.045316Z","times_seen":53,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"7335be571d1f9586a0cf2f6952c4eec4","sha1":"f3b60c35f4f7b75ceb1266dbda8ac8d4b1ef11ce","sha256":"da1bed209470750a6c89d8f016d11e981ac975127f5db25aaf094404ecbec64f","sha512":"cebaf60fe3f7c0353c89f2de080ab49e6a5fd65040c113ae0d46f9b10f4b991b00bb15d61e287a60fe714a03569ee0fba4247de1acba85fd8ce02484aca505c1","ssdeep":"","tlshash":"91411868dbbe7662832ea0b62bfe52de143e547e7a814ebb7c38405048f48493715c7d","size":1934,"data":"","first_seen":"2026-06-10T08:18:22.002783Z","last_seen":"2026-08-22T08:07:47.046053Z","times_seen":27,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"a9e76c57e7d8f6206977f40901c102fb","sha1":"461f9a046af8fd0b36977a63b44f59e6cebccf61","sha256":"448c8218627802c696ce69f7851f02254455c289182cef8ff9b533c2cbf2ac66","sha512":"5206003d360ac49c465c3ffef2ff0559b144b5f63a1d1166ee686f2a62afaf9c0c89f34da2b4f7a265e6088c259a4e694379348b7eab35378584cb787ccc7290","ssdeep":"","tlshash":"4f41fd31f37d253147bf64b529e5269e2a3990823e878ca6cc9c9c0524c1f5d4875cfe","size":1915,"data":"","first_seen":"2026-07-22T10:08:06.684621Z","last_seen":"2026-08-22T08:07:47.046673Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"fa9a2e00541c5d978bbf0a6222ba76b6","sha1":"e3bbc246c652e6594c458f3eaccf859d9397eccb","sha256":"5c3b561854db1a9db55f57069bf0ef0b5b12d741130b1114a18f4c65b1a7d381","sha512":"88f6ed907a6edcba1ac4e7446911ba0b3b9aeffa748363bb42a31676c5edb62755f25a9adc29f495db93a874641ce13dc1f4b461b8ee4dc541e5692d66dc1be5","ssdeep":"","tlshash":"3611ce28b6be043286637129266ef6cc7979006bac11cd0ebd2d8dc80fd0e519db6df1","size":1071,"data":"","first_seen":"2026-07-08T11:52:31.654177Z","last_seen":"2026-08-22T08:07:47.047284Z","times_seen":26,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"e7c749255f0c7603b90f6196e3087ad6","sha1":"87ca6ed12bb4d899eb515fcbf1b06cd77bfecf35","sha256":"6c91320d2a35084146720e73b9eb506f8f042d304770136f76fdb279d3e82c90","sha512":"17c60dcf3f92c9719372b169ccdad70f329b88e816784043bc83bab6fae403aecab83deda08b8a8c2727ad201d11b2641646e45548d69e9accdadeb0566a3038","ssdeep":"","tlshash":"02b0128b74a73d50828fc7b44d23ba014510208782afc50875e59d3096718c0b4c352f","size":97,"data":"","first_seen":"2025-12-03T09:23:15.289558Z","last_seen":"2026-08-22T15:45:08.19914Z","times_seen":47099,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"af88d2da7f975da3370f5ebf3e291f3c","sha1":"ffcfeaa7015cf8210703c18dd0c4b5984099ffc4","sha256":"a76a02f6b8bad91436f9d88681c7490200969190ab32ccb418b6c8f530c5a424","sha512":"e2fe80f3cb7ab51e993c8e086a52d87c35de9897a638afafec7d9420da6a160337ec6a8283c7b1cbc44988d1c82a699a0cf8d01d004c2e5d59171ed3b847e52b","ssdeep":"","tlshash":"a401f4481cf8de26449262c939bf7649b17cf950936f6c03750e054e5b6197caaf374c","size":688,"data":"","first_seen":"2026-02-02T04:06:01.044192Z","last_seen":"2026-08-22T08:07:47.048528Z","times_seen":89,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"4cdce530d1b78748b7010e758350fbd5","sha1":"2afcc76066d23fbeb2425c750e6dd20a20a48145","sha256":"aec522c095abfe84333e9d65578dd30963b7721929993819d7b398f24ef5b160","sha512":"170f1631d052984e3692a3a8c2d4684df63ed9eeb74e524dca42cff607b8f0756622d1cfbe2c3b8fbcbbcbf40dcf6434da65643f62da70bae48baaaa12d86973","ssdeep":"","tlshash":"0bc0129a95a82d4914e5c16801781226b11895178b2b5e65b24e404c5fa8079b5245ca","size":190,"data":"","first_seen":"2026-08-22T08:07:18.407607Z","last_seen":"2026-08-22T08:07:47.0491Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"ee11881e5c172fa871d1d81ac187f199","sha1":"7739fa3580dfbf07780e3b04206b2d1aa499633c","sha256":"9ddf19b0463e7a3007509018613c854fd4554d6cc5655156fcca5d06d0d8642c","sha512":"9dab4aa3de9ab5f92a6c204e2f95947e0eb4cf610b1c562a9155225f42cb0b10fbc7b436f1131ed180b6b2ea655d98fd4c75bfe379d2abe6ef29b5d317bb5407","ssdeep":"","tlshash":"36e0c280a25c1d54e193363b7f3645da283847b159a2d8acc88fad503052c4047eb5e8","size":292,"data":"","first_seen":"2026-07-13T15:41:17.295845Z","last_seen":"2026-08-22T08:07:47.0504Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"4e3654e134faf193baccd07c1b7b2def","sha1":"bbb4df49a47d7b41c423f36582568661960ed7b2","sha256":"75cdb26c2a8969a63a858f926941accb680e2ee7a078c4ef5a66f07405fd816e","sha512":"4c70ba39a1bedec499c0a5e51f45d382b1fb5f6ace20a1891aeb044122eb3cc70764d4b22602735d4fd748a05640e2277ebff96f323a6c86c60c43c11202260d","ssdeep":"","tlshash":"4eb02b554ed01f0211840ed90424423b119c2120cd209c108282c444002c5419dd8404","size":122,"data":"","first_seen":"2026-08-22T08:07:18.411392Z","last_seen":"2026-08-22T08:07:47.051047Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"6e782184d1bed1de34118d1eead04029","sha1":"88eda2a5dad5c6d5f1c0c2619e6c4945be6da50c","sha256":"4b74ce357303ca19a24909ee9bb4e567d18c0218ff1022ae361b7ec4830e608f","sha512":"e87920db3f120ac45b4b45721c40fa23899ebe4cb9c401ed5b1527151546cd401b47615c3a69d214f581f8609dc68a2483dc977662a3cb5293473498e7a1d315","ssdeep":"","tlshash":"9821bb3b7e7c88ba47c473981694484f92dc5191d2a9855ce146ec38817c36bafeca07","size":1127,"data":"","first_seen":"2026-07-22T10:08:06.692377Z","last_seen":"2026-08-22T08:07:47.05198Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"fd29938f1ad524bd6ba87f4c0bdf291c","sha1":"ccce2f1c6e49b96f686e080b7b85695a08b0adba","sha256":"c98099d4cd33c13298dc59ce0c8cf912d68a0ab756ffe1fe733dd2b224f08106","sha512":"7a3a9237343dd8840f4d9788b4e88875c086b4ca6703759708bf9ae22e1d7d781eb0f9c96dda0d3d2d1b7a2ad3f2f73262ebf8c149440c5b4865e5cc2d5d803d","ssdeep":"","tlshash":"04f059db6b5c0432c25f305e105eb3cc3d7d803269412d67fc78c45248e0d98966289d","size":545,"data":"","first_seen":"2026-07-08T11:52:31.658162Z","last_seen":"2026-08-22T08:07:47.052583Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"6dbc1008a0655ecb932c1fde0eb72b0a","sha1":"2e64bf12bf7529f841baceb5ac9d5089ddfe9794","sha256":"2d65e312c8a0eed794d22cb196d1fabbf363edc0db34dc532345c58ade40c7aa","sha512":"312a05df4c4d92127ba8f16b8dbf05092762e348a050ea66d7821ce6b47f01415d89448a6e2d677e8167cfc76c0e282301761845405e54224c37be2933eac27e","ssdeep":"","tlshash":"d0216bd2f74c1532c4ff357eb45a42cc262d9071bc2018ba3d6c622c0172f8c55a679c","size":1378,"data":"","first_seen":"2026-07-08T11:52:31.658994Z","last_seen":"2026-08-22T08:07:47.05324Z","times_seen":26,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-includes/js/dist/hooks.min.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"140ad332a76e011554bcab096a37f4ac","sha1":"72c9da62a624a99da82f8b53ecd2ba8d8e1bca88","sha256":"fc774906082b59dedcfc55b8ef127783b6d056578ff4586a8ebbdb81bbe286f1","sha512":"ccf2833ab9908f740779b84bfd97903f96572aedf6eb0a37f08e51a88f0634e03408bd3e87e2e0586483835a6e09736848e44907848902ef11f8114a21029eca","ssdeep":"96:Fu/16WIHBLusBcADGDd/R5h2RTLlD3jMXY2yGy94E34sTY2CiB:FGIhNBcAD0NRv8XlD3wXY2yH+EoaY2B","tlshash":"4fb163c43542b830e2777027f0ab58d46175abe1a82d8446d59cd8f12da39cee0e7b3d","size":5107,"data":"","first_seen":"2026-08-19T23:17:42.247117Z","last_seen":"2026-08-22T16:28:13.6351Z","times_seen":564,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-includes/js/dist/i18n.min.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"d2f655e068f223e5da12d436aac88d38","sha1":"003146f39636a30ac250b0f043d61bcc01117b17","sha256":"5083905862c2b7aa8a84c4f2313d359d2288fb25fbe1ff577fa7325eff2ed2d9","sha512":"c3fa9c3955bbe3b74e30755c4c551204aa1a034f8d48c8ab2747eca57466409ac0dfbdfc76a7a3554ea64cdbd730bf3cae3c1270382e66df24afc8b8ed48bf38","ssdeep":"96:oE7/RPgrMs4WLJOmlWS33c0xyE2B1596NiH826V0NG7CXMGOyd/sEomkKvYCGaMs:Xhgws4WTBYNB1C9aNwAMPyd0R3SGaMSn","tlshash":"f6c1a8c979def056235910a594afb005e134be2870deb800aae0c4957eb44cdb1b7fba","size":5791,"data":"","first_seen":"2026-08-19T23:17:42.197722Z","last_seen":"2026-08-22T16:28:13.653216Z","times_seen":564,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/contact-form-7-js-before","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"d6835e45faecc5573532cd68d5938521","sha1":"380fe706a53e14c2973d36ec291407ab4d36dec7","sha256":"802802584586d05958e68b4dbb645c6f175d87cc6536f69d34e02dcbb07c66dd","sha512":"4049aeaa69a437b39f62adb0beee3ba3d6fae54f8a627e82359bc0c7b9e92f9065006d92829898067baf48ff7450ea1d04db26eff9e1cde1f950e29f5b08313b","ssdeep":"3:HT6SVGDSiCmbFFlHrYLdjKBF/FFhhzVEGUHsR5pHdFQhN9GEawUWKLlUFrQAv:HLiRhDmdW1ulgpwLkuKZ4rQAv","tlshash":"bbd1129ad5a82d4914e5c178057c1226b1189517cb2b5e65b24e404c5fe8079b5285ca","size":6387,"data":"","first_seen":"2026-08-22T08:07:18.392793Z","last_seen":"2026-08-22T08:07:47.053839Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/dist/js/scripts.min.js?v=1.2.5","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"5941c8cb55bde4b2cc24a6ed4ff08f1a","sha1":"6ae966638ac68880e24e46c9d66f4e54b2e902fe","sha256":"6c7214f211a09d913bf9d0ef5a2e420ea78d4275d15bfb6ed07661c12f1f7963","sha512":"489f44ac531a6876ab4220ad32cc9e1b2631767168d4d6b4d123accf36e7ee2bebf861d023494ea3210265ef8b1473893122500c603cceb0cdcd0a78e2bb9562","ssdeep":"192:ajmU5FJoVRReWlAWLAGw9rPBImzgcxh2xYRvGQORa20WGW/dc7yyj/qCho:OFJ+RDAGw9r0hJ7","tlshash":"5602535653b22c7d45736a195e7fae0679b880ab1d83e816380ff4804f784fa43b47e9","size":8485,"data":"","first_seen":"2026-05-02T07:09:17.931605Z","last_seen":"2026-08-22T08:07:47.021067Z","times_seen":27,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g10102301085.co/gr?id=-Nx8NDCxoi5XHExf6J3e\u0026refurl=\u0026winurl=https%3A%2F%2Frainbetlegit.com%2F","fqdn":"g10102301085.co","domain":"g10102301085.co","tld":"co"},"ip":{"addr":"34.120.31.228","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"76c7778e369c280777c7d8889a9a8e85","sha1":"f57a0a4c724f864c11faeab748e51a6a6e583609","sha256":"c5048d5003cbdfc61ecbba655e914de5c09f349d0d85306ef23f5e34e7e3acb3","sha512":"1fcdf37f78b33db612bc9f4159c8148e77bbf0e97b2b6b9f069fe738730e186bf3fed0d5b51bd9c90880d6bda7195416a2ed9dc02487ad202c3dd29ec508bf8d","ssdeep":"","tlshash":"70e026e8b6ea613050f766ac2212c42138736032334c18ebe860236a7ef011e811a7ff","size":352,"data":"","first_seen":"2025-08-13T16:04:47.939696Z","last_seen":"2026-08-22T08:07:47.041544Z","times_seen":34,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"087de03e5dc079a0742ac8478a5f8c87","sha1":"b14ad9cfa3fa6ae9381806189e7f35f543d185ed","sha256":"fe345dc92f2c901c2eccac134294ff2216e70177dd054ba6f104af6015959ee9","sha512":"5742b4c16babac5856080614523b47dff4f3dff7cc102a3a5474ab1e0c82de4a1e987327beb303775042727b35d3f2498f6916c6283117415725dce206c437ef","ssdeep":"768:k4cjy6JZaYSJjv+YfzwLpstNyuGFGgxesKNVhIkYJO2ybEXoHHFC1aRHQpmiVKbX:IZal8OHQpmZNemLECFKAJ","tlshash":"3903e8b93a9c90b416ee87ed37abab48e4303961dc0fc8609565dc542258dc70f9bfb1","size":40647,"data":"","first_seen":"2025-10-07T21:11:17.93794Z","last_seen":"2026-08-22T08:07:47.029555Z","times_seen":8301,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-i18n-js-after","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"ef2adc07c2ad8814d9e38bd213be6cce","sha1":"94ab84cd98d05244af12a0cbcc12107274426418","sha256":"50e2b34e58eba316b4b4e0da121847ef45ae75f7dd3b94f23d28f70b4ab5c185","sha512":"66dcf862c09e9d54717f7b7d1a5dbe02e6f42f49dfbbddf703fe1b0f4d67c79837f45d76e1305b6cce3b85698c437334a27b644092d42d5a892856915e4b652f","ssdeep":"3:H6aUdLLxkFAhEK49MQGmVB4iFM/KGNVSJFo:aBLxTqtGmVOiFM/KGNMJ2","tlshash":"36d112cbf4ab3d50828fc7b48d23be0145502487c2afd50875e59d3496718c0b4c362f","size":6281,"data":"","first_seen":"2026-08-22T08:07:18.421434Z","last_seen":"2026-08-22T08:07:47.054883Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/contact-form-7-js-translations","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"26aa14240d4f5d1e1705e883283c8983","sha1":"bc853e5dfe190a61c5bcd2014dfabd00727fc8b0","sha256":"e56cda2aab654c7f6eb1f838599971b0a96d6ffe69f5a380cc63e5c6dab138a1","sha512":"8d5dc522f8fd1da7c8a41766330dc54f49a8ea0dcf8d607590da9fb93fe0cd4c438ac6d21110f8972bc8244b775f449102d3bf09229de60fa5eb0446ae0bb1df","ssdeep":"24:aq2WBWUcWLNVT7sJKcdSxHTDljcvHuc0ZSWv:d2WBWUcWLrTY4cdEHTZFSWv","tlshash":"19e11544dcb8d915449252f539be76487038f550c36b6c02710e040e566156c95f374c","size":6877,"data":"","first_seen":"2026-08-22T08:07:18.417383Z","last_seen":"2026-08-22T08:07:47.055882Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/contact-form-7/includes/js/index.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"2912c657d0592cc532dff73d0d2ce7bb","sha1":"70a679e2769825236f83bcc56965a9d0bd86c4e9","sha256":"ddcce687729cb358abf9d0d8e1217a097859be2b0d18c23d7c851b38c87bc9c0","sha512":"9646384e65d09bf00cb20365f43e06dd41e7428e3fc6cc2737f4e69b50f006ebb25bd24a566fcd9faec2f0dcb24404e25d57ba7b8c6aba61797a29c515ad5144","ssdeep":"384:IsIRHeFJ1yQ7QdfnJgeYh7MXlsNqrBp1pgQpwOjNtqohIQ/5Z:IsIR+L1yQ7QdpYh7M1iqrBp1pgQpwOjn","tlshash":"0a52d7a1472955321eb506e391e513c1769075aef44b8aa1a898dc2e18bdcc328f3ff7","size":13452,"data":"","first_seen":"2024-11-04T17:50:00.022634Z","last_seen":"2026-08-22T16:28:13.586264Z","times_seen":237228,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/scripts-js-extra","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"119050d1db63aed598ad3f55791843ec","sha1":"844b69c88e790134f7ce182d1725072ecbeddc65","sha256":"83c5464b9e4e76089b8bd01c6b2042505c3b5f0fad69268e5ed8e6cd51c1187b","sha512":"5a51bef4af27a660a92f529d7e8bcce163654629ee63cd396b68e6ba28d3609ec9986b24152d967fd53ad46955f57f58b5bb7077d96a021eae31da5c5211e528","ssdeep":"3:Hz6EDew5vNVYLd2grTHnJH+LX/dTFKHWvGY3r:P9xGd2grTQLXDKeGY7","tlshash":"69d12b55ced01f0251840ef90828423b11dc2120cd60dc108286c444002c5419dd8404","size":6339,"data":"","first_seen":"2026-08-22T08:07:18.41939Z","last_seen":"2026-08-22T08:07:47.056914Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/simpletoc/assets/accordion.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"4440d679d097638af0608509e706e642","sha1":"c897ef6bce63b52372e28a415d6d49088108a662","sha256":"169f6f797ab62f0af18a12c81dbff9076ac66b441abdd296a2acda5bfbe200c7","sha512":"b7db759cc245eb52919e34f7e657af3147a6968c2ed5fd44e3cad970fe0b904db6bf185a3c2cb506d075a4a5f3f0a4f502ef55addca044b837789db63015a904","ssdeep":"","tlshash":"4af046b46b2c333647e9d0455c1626d6763cc006ea41a4eb0c14ccdd28c8ea469eb6f6","size":598,"data":"","first_seen":"2025-06-17T02:00:31.745723Z","last_seen":"2026-08-22T08:07:47.002071Z","times_seen":65,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/contact-form-7/includes/swv/js/index.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"96e7dc3f0e8559e4a3f3ca40b17ab9c3","sha1":"d363d0291e92c233e828023583dcf6685f2da5a2","sha256":"29fdd17a7002a2e1bbd9b33adafc53457c64006b5aca8f6e4dbf907de35433ca","sha512":"851dcea59510a12dd72c8391a9ea6ffa96bcbe0f009037d7a0b6e27bae63a494709b6eee912b5ed8d25605fbb767a885f543915996f8a8aff34395992e3332dc","ssdeep":"384:wwuf8OQL0sARrAZcNWLq/+Ffm/hibLexa2VautyX2fsL3ZHO1O9H:wwuf8OQL0sAZAGNWmGcibLexa2Vau0XD","tlshash":"d34235e16197e0f0c7c338a48816c051f2bf866cb9898054fb5dcdd22d5de07626b77a","size":12512,"data":"","first_seen":"2025-03-11T19:47:45.42406Z","last_seen":"2026-08-22T16:28:13.629197Z","times_seen":230250,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/dist/js/header-search-logic.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"95a9aec3eec3385f61adaccf426e2fd3","sha1":"67e44e58f75a4514ba008c2ee3d5dcfd307c2a75","sha256":"52cd79f5c766b41f3be8b2c592ffa11eb63d657ea8c77b8d2be5875a2f98abe8","sha512":"a78a430b4249582e89a6da526bf80eec5e11991c0c780e248e53c3acb9b315b60bdd03082eeb146fd9d218cf61952ab5408afa40adba8081e03d1dfee3cca148","ssdeep":"","tlshash":"7511b4396128b439923b01c7d266afd53d59008ff840427966ac47ee2fc1ce3a3625fa","size":984,"data":"","first_seen":"2025-06-17T02:00:31.74037Z","last_seen":"2026-08-22T08:07:47.03664Z","times_seen":63,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/pll_cookie_script-js-after","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"6b17bc46a48f692283fed0fcbd49047c","sha1":"639f2ebe0c2878ec9748a84d1bc33286e94577d7","sha256":"f16af540664641125b63a56b07aa4596bdbc34e03970af0eacb86dcda5b23e4d","sha512":"e26c04a3c3f72a8a8b5c9a30500969794fe5306e44317c580ec6954ca9837a16b1b5fc050d6636f6e2fa981f2b499606dd61439a3cf7630d178571925cb79e38","ssdeep":"6:OyW/zF0MMHYYWKWWaF2V/xYJpjqzq0GO08IFhE7Mv5l/w2:OyW7F0MM4YaWaFCSjq+0JZIFhKu5l/w2","tlshash":"2fd1c280e25c1d54e193363b7f3649da283847b1d9a2d8acc88fad503152c4147eb5e8","size":6500,"data":"","first_seen":"2026-08-22T08:07:18.423409Z","last_seen":"2026-08-22T08:07:47.058261Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"opt-in","filename":"https://rainbetlegit.com/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js","line_number":1,"column_number":21068}]},"http":[{"url":{"schema":"https","addr":"rainbetlegit.com/wp-includes/css/dashicons.min.css","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.203Z","timestamp":1787386036203,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-includes/css/dashicons.min.css HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 22 Jul 2026 06:34:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a606486-e67c\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":59004,"size_decoded":36087,"mime_type":"text/css","magic":"ASCII text, with very long lines (58969)","md5":"6c05185027c3a169cea5b065ac28b6f9","sha1":"d075b19cf8656586e9a561d00ea64f19ff0218ee","sha256":"26a7e7b9d4bb9948771c126085b99fba6546af4399e6263e8a69a3e33f6271cb","sha512":"ecb2602801c8b16c7c079c8f76b09e7b42d71000ba3968fc8c173f8c88cfe99e3739f1cc0149ddea7e69e04755f9b077c48f622e7ab8275ec8b4fdf040ee81f5","ssdeep":"768:oey/Z24B3P3aXOhUzSv16CAyLquqSfurIdUMbs73KO08QSJ2BQH02CRqxMWs5IJq:ox/ZvB/qPWMiquqioMUXQSJYIMW+IJq","tlshash":"2c43c2b1a74a40d677b0c843af65b26a5582bd7df8409cdef40b821c1af3635069dfb8","first_seen":"2025-12-02T22:25:19.065399Z","last_seen":"2026-08-22T15:42:40.493548Z","times_seen":69416,"resource_available":true,"data":null}},"time_used":66,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/simpletoc/assets/accordion.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.481Z","timestamp":1787386036481,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/simpletoc/assets/accordion.js HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 598\r\nlast-modified: Wed, 03 Apr 2024 22:09:28 GMT\r\netag: \"660dd398-256\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":598,"size_decoded":967,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"4440d679d097638af0608509e706e642","sha1":"c897ef6bce63b52372e28a415d6d49088108a662","sha256":"169f6f797ab62f0af18a12c81dbff9076ac66b441abdd296a2acda5bfbe200c7","sha512":"b7db759cc245eb52919e34f7e657af3147a6968c2ed5fd44e3cad970fe0b904db6bf185a3c2cb506d075a4a5f3f0a4f502ef55addca044b837789db63015a904","ssdeep":"","tlshash":"4af046b46b2c333647e9d0455c1626d6763cc006ea41a4eb0c14ccdd28c8ea469eb6f6","first_seen":"2025-06-17T02:00:31.745723Z","last_seen":"2026-08-22T08:07:47.002071Z","times_seen":65,"resource_available":true,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/822c111c-69a1-4978-8284-4317ae125eee.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.556Z","timestamp":1787386036556,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/822c111c-69a1-4978-8284-4317ae125eee.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2080\r\nlast-modified: Wed, 19 Nov 2025 12:52:21 GMT\r\netag: \"691dbd85-820\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2080,"size_decoded":2423,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"25bd97ed63cfcab632649a9f1886b27b","sha1":"ae95f1d196dfa3c01032c49fc496c1ad1e1734c1","sha256":"0b4507801a93c0414ea01d747d4f56aa6c3bb6058def83fca97fd2c049d5477c","sha512":"78bcef71cc4576df1a6d70bc119c7aeed2aec94ccb3705006b246803ef3f2e29d77a7dcc496cad9e65f3ddf26335fbde21c17557feec24f2f2337f5a7bbb0623","ssdeep":"","tlshash":"3141ea56a779679fd4230fbc22c50f41c7d52366439495b0c70852716f992dc79ec4f2","first_seen":"2025-12-08T04:02:28.613589Z","last_seen":"2026-08-22T08:07:47.003689Z","times_seen":20,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":156,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/84182e5f-bf10-4af9-bc9c-8a55ff649655.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.557Z","timestamp":1787386036557,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/84182e5f-bf10-4af9-bc9c-8a55ff649655.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2598\r\nlast-modified: Wed, 19 Nov 2025 12:52:22 GMT\r\netag: \"691dbd86-a26\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2598,"size_decoded":2941,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7a69313e28331ed4a0029c7cea05d82f","sha1":"bd7538d80e7246d6c41eef75ca8a539a345c4aa8","sha256":"c28b69fa77da238487da5eeaea9f36141f09a10e0598ad4298e2136872456624","sha512":"8daa63f76dee4f1a9eccbffdaa3fbf8252f1fb7f26e5a25b91ec80109bee1b0c8c37e42cdc8c61f012219f5d47fda052a19b080eb7d70e342914a215f9ab2833","ssdeep":"","tlshash":"0d510a5a77286b66c90213f920c0b3a6fbc83e578e83d95044c146846f66ad756ec44b","first_seen":"2025-12-08T04:02:28.672912Z","last_seen":"2026-08-22T08:07:47.00549Z","times_seen":20,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":155,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/images/icon-email.svg","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.629Z","timestamp":1787386036629,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/icon-email.svg HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 611\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\netag: \"6a70f05c-263\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":611,"size_decoded":956,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a7175dab5aa6a0596cd216f0636a4ec2","sha1":"a21c67d4d3feb62eef9029cc24cab0b4d01ac665","sha256":"7fdde8a57a9525b48fbac613dbfcfbd0bd88651dccae976d382637a6b83306ac","sha512":"41d8bf0ee07374b8fde10493c14715c5491744eaafed644f4be15895236ff503bac0ed029a5647bfca2029186a77038de14b3231d31f4b2bff06302b21a04612","ssdeep":"","tlshash":"4af002d482ee1d91810bcf90b52b7d12f46721f91d3cc15c01a5a114f87c56f5c1c8f4","first_seen":"2025-06-17T02:00:31.748608Z","last_seen":"2026-08-22T08:07:47.006925Z","times_seen":18,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":140,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-500.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.705Z","timestamp":1787386036705,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-500.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19580\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\netag: \"6a70f05c-4c7c\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19580,"size_decoded":19925,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19580, version 1.0","md5":"95c5b525d84aaf5a8411f6ae51916cfe","sha1":"426515e1c6be3e3b101c0c79f29741ea57cdb0ec","sha256":"01ffc8802167df3b7c029549092fd0aa9f0712e089ef4e26c543376de69faa91","sha512":"24907cb28e09ebc62f256916b1a104a53f53b4b284c78380ce450efde9081772bab7b1772dccc7c464e9be21ebd2ee8e023046714a047fd1973b68969bc90685","ssdeep":"384:q2wsotK+EWugFk5Ab1n1sHQySPOqTJ7BsARD5Wzxy7ZlcU+jXzauPc9m:GzlE6r0wtsALhjuWuYm","tlshash":"af92e1217443c4c9ee3d98f24e4fdf3481b8de1d097e21592ed24283ebe57449a3e945","first_seen":"2023-05-01T05:27:13Z","last_seen":"2026-08-22T08:07:47.008897Z","times_seen":206,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/lars-round-300x300.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.458Z","timestamp":1787386036458,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/lars-round-300x300.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10210\r\nlast-modified: Wed, 19 Nov 2025 13:59:19 GMT\r\netag: \"691dcd37-27e2\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10210,"size_decoded":10555,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b65f12b35cd16ca2e503e01dde6c962c","sha1":"9ad3d0b9c00e36025604565c9724c0552e17900f","sha256":"4c72be52f49bef6d92b8845a6618e7cc4d075ec2ecebd57c4a87573316bea48e","sha512":"b1f926daf6e723adf25c6936720629ba464cf7bec6ae3bc347feec9e6ed1100d34b46cd55c2f76ff1ab2b0f64d2f0e71e61fb601f58bd3ccb508c1d4f3f814fb","ssdeep":"192:uln66V20OXrsd9wuIqrNYuXd+Eh8PWbA5lkneWvNQaA/ksoPvXmtMFSq2ecXc:ul6/rXC9wuJNNQr+akeWFQaqAnX5Eq2+","tlshash":"1822af009de15c71eff35af4a1c5a9cd4a2f1a8c546d8f44fb37bc5a0594647623838d","first_seen":"2026-08-22T08:07:18.348564Z","last_seen":"2026-08-22T08:07:47.009769Z","times_seen":2,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-includes/js/dist/i18n.min.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.468Z","timestamp":1787386036468,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-includes/js/dist/i18n.min.js HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Thu, 20 Aug 2026 05:36:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a86927b-169f\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5791,"size_decoded":2868,"mime_type":"application/javascript; charset=utf-8","magic":"data","md5":"d2f655e068f223e5da12d436aac88d38","sha1":"003146f39636a30ac250b0f043d61bcc01117b17","sha256":"5083905862c2b7aa8a84c4f2313d359d2288fb25fbe1ff577fa7325eff2ed2d9","sha512":"c3fa9c3955bbe3b74e30755c4c551204aa1a034f8d48c8ab2747eca57466409ac0dfbdfc76a7a3554ea64cdbd730bf3cae3c1270382e66df24afc8b8ed48bf38","ssdeep":"96:oE7/RPgrMs4WLJOmlWS33c0xyE2B1596NiH826V0NG7CXMGOyd/sEomkKvYCGaMs:Xhgws4WTBYNB1C9aNwAMPyd0R3SGaMSn","tlshash":"f6c1a8c979def056235910a594afb005e134be2870deb800aae0c4957eb44cdb1b7fba","first_seen":"2026-08-19T23:17:42.197722Z","last_seen":"2026-08-22T16:28:13.653216Z","times_seen":564,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/092657d8-8e83-484a-9717-442ae1ab7886.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.558Z","timestamp":1787386036558,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/092657d8-8e83-484a-9717-442ae1ab7886.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2650\r\nlast-modified: Wed, 19 Nov 2025 12:52:23 GMT\r\netag: \"691dbd87-a5a\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2650,"size_decoded":2993,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b0cd28c3b7fd01c4bd0a91491643354a","sha1":"68f553857f319be3598b919912eacc9723a1b995","sha256":"cf5f2c4057c53433704fc056bf560ae224b401741bfd2c41f020c7bd68d7aed9","sha512":"c5fe40193e39969119a7b8ea330601a20c993ecc818e8103d081109e1a30aa35fcacff691f591ba06db37271e9b5604853c181a0d5add84f7fee638b66e6b563","ssdeep":"","tlshash":"44512cff1f64860ef10426bd68aa8deef5c9ab1289587f54b2d3012d4b13dc06c6538b","first_seen":"2025-12-08T04:02:28.678906Z","last_seen":"2026-08-22T08:07:47.012305Z","times_seen":20,"resource_available":false,"data":null}},"time_used":157,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/images/star-icon.svg","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.631Z","timestamp":1787386036631,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/star-icon.svg HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 282\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\netag: \"6a70f05c-11a\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":282,"size_decoded":627,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"47d7d44c0e7cba35b9903fcf5056c2b0","sha1":"7396eebf4cd6481f68577c7ed618da3848c7dcf5","sha256":"e1b89f9939709042aeb824ac851db5b411a542f91f50d143d118f7f1b331897a","sha512":"477b9212fe22b98d53eb7b11c3d1f2382f042c4c534a0db74ac721edba0783a71ba546cc1035889b3998ebef7a658bbe24ce3a7c8abc32e5816d08ebb7a496d1","ssdeep":"","tlshash":"ffd02bfa50ace9064044c724337a6c3d31e730be08de110d69c2f1a1e5794d72e2c9d8","first_seen":"2025-06-17T02:00:31.751022Z","last_seen":"2026-08-22T08:07:47.013369Z","times_seen":138,"resource_available":false,"data":null}},"time_used":139,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":138,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-500.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:17.075Z","timestamp":1787386037075,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-500.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv; c2_popup_unique_name=GVgRBVsdH1UdDFAMRVoXBg==\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:17 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19580\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\netag: \"6a70f05c-4c7c\"\r\nexpires: Mon, 21 Sep 2026 08:07:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19580,"size_decoded":19925,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19580, version 1.0","md5":"95c5b525d84aaf5a8411f6ae51916cfe","sha1":"426515e1c6be3e3b101c0c79f29741ea57cdb0ec","sha256":"01ffc8802167df3b7c029549092fd0aa9f0712e089ef4e26c543376de69faa91","sha512":"24907cb28e09ebc62f256916b1a104a53f53b4b284c78380ce450efde9081772bab7b1772dccc7c464e9be21ebd2ee8e023046714a047fd1973b68969bc90685","ssdeep":"384:q2wsotK+EWugFk5Ab1n1sHQySPOqTJ7BsARD5Wzxy7ZlcU+jXzauPc9m:GzlE6r0wtsALhjuWuYm","tlshash":"af92e1217443c4c9ee3d98f24e4fdf3481b8de1d097e21592ed24283ebe57449a3e945","first_seen":"2023-05-01T05:27:13Z","last_seen":"2026-08-22T08:07:47.008897Z","times_seen":206,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-600.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:17.079Z","timestamp":1787386037079,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-600.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv; c2_popup_unique_name=GVgRBVsdH1UdDFAMRVoXBg==\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:17 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19464\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\netag: \"6a70f05c-4c08\"\r\nexpires: Mon, 21 Sep 2026 08:07:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19464,"size_decoded":19809,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19464, version 1.0","md5":"765a7790e9005f066ddfbc939bdd4621","sha1":"c730bde751b462838db69f24c2c94019f964e029","sha256":"3c316558e18d2996ed4394bc36b17d993c21584f30d16dd0e6d87673f5892c18","sha512":"06147c122afcb704457b3a2775d7e375bb7672a47faf8b4743d12b88a784b20af6580882286e2adb0dad9dfd22648e4994e72f54013172680c2c596fc142ed48","ssdeep":"384:7MtxnDHqurSlYJePkNY2PEJrIJpbXHjn8Q3XSPb0W2pphsPwnyuDmsJlbrUM:7c0ukPkjsx2bXz8LTv2bAu6Sl/UM","tlshash":"6392d0bbb4af74f06d03bd33364b1ba1d9da25412cb8981842f7f481a9fbd88e655009","first_seen":"2023-05-04T15:17:50Z","last_seen":"2026-08-22T08:07:47.014051Z","times_seen":199,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":52,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-22T08:07:14.860Z","timestamp":1787386034860,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:15 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nlink: \u003chttps://rainbetlegit.com/wp-json/\u003e; rel=\"https://api.w.org/\", \u003chttps://rainbetlegit.com/wp-json/wp/v2/pages/2\u003e; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\", \u003chttps://rainbetlegit.com/\u003e; rel=shortlink\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"Complianz","description":"Complianz is a GDPR/CCPA Cookie Consent plugin that supports GDPR, DSGVO, CCPA and PIPEDA with a conditional Cookie Notice and customized Cookie Policy based on the results of the built-in Cookie Scan.","website":"https://complianz.io","common_platform_enumeration":"","icon":"Complianz.png","categories":["A/B Testing","Cookie compliance","WordPress plugins"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Yoast SEO:25.9","description":"Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.","website":"https://yoast.com/wordpress/plugins/seo/","common_platform_enumeration":"","icon":"Yoast SEO.png","categories":["SEO","WordPress plugins"]},{"name":"Contact Form 7","description":"Contact Form 7 is an WordPress plugin which can manage multiple contact forms. The form supports Ajax-powered submitting, CAPTCHA, Akismet spam filtering.","website":"https://contactform7.com","common_platform_enumeration":"","icon":"Contact Form 7.png","categories":["WordPress plugins","Form builders"]}],"data":{"size":276354,"size_decoded":48283,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5262)","md5":"3e9fe1c7afacb7fbf1ed2b656f4bbafb","sha1":"55236aa235de75db0cb24a72803051dfea7358b8","sha256":"f6fd66dc25ad26aab0f941081e95725a3656a1c9ae5a5e28cdf42d5033dbdb79","sha512":"f394d4e1f7aca247599a6118af9c6f17b63fe90e47aa7ce6d6b23a39d066db1910c40e8e0b0956f92bc923fcb9b17de8537a75d4a3dca8b95aa35eddd8b452fa","ssdeep":"3072:oUPOL27oz8ADp+DM1No5fhgGBOl9jzk7q9O:oF27NADp+DQG","tlshash":"7a44f86b46a72059392b727c4fa6270c626d8017cb15cdf8badec148cfc9a95c8f274d","first_seen":"2026-08-22T08:07:47.014711Z","last_seen":"2026-08-22T08:07:47.014711Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1079,"timings":{"blocked":-1,"dns":3,"connect":54,"send":0,"wait":949,"receive":0,"ssl":72},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.447Z","timestamp":1787386036447,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/font-awesome/5.15.4/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 10462\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 13 Sep 2021 19:10:03 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PCBwfwbTiwc%2BBmOUctSiBYTMez1gQJ0UxBL%2B4EHOYUoQxNOj5sTAsnG0GyeOp5%2BBciozHRP%2BHaLIYBOO0ddsd9hCEh3m7ZbengWRsKeYl%2Bh%2BO6Q4XLA6pLfp5Xd0hoOvD4rC6Jxq\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-ray: a2f06207efbf0b41-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":59305,"size_decoded":11459,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (59119)","md5":"ecd507b3125edc4d2a03aa6ae5d07da9","sha1":"a57ee68d11601b0fd8e5037fc241ff65a754473c","sha256":"99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e","sha512":"d72727e8871a410e34fcc2815b65b84618acfc36c82d4ef80b5bd2acb2710aae7ba3de35626d354b036c38caaf10116572051aeb12e23d8fcd4b947e13aced25","ssdeep":"768:PEh31IPiyXNq4YxBowbgJlkwF//zMQyYJYX9Bf7VSzl:PE0PxXE4YXJgndFTfy9lQB","tlshash":"8c43fbb8e54c01cab731c44bef81b2bc61b6f73de5914d95f00e691c2ad26a811c5fba","first_seen":"2023-03-13T09:02:16Z","last_seen":"2026-08-22T14:19:17.235596Z","times_seen":48037,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":3,"connect":15,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2021/06/leon-casino-11.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.547Z","timestamp":1787386036547,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2021/06/leon-casino-11.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 18550\r\nlast-modified: Thu, 20 Nov 2025 07:06:29 GMT\r\netag: \"691ebdf5-4876\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18550,"size_decoded":18895,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"166d03399e00fea5ee95682848ba6ced","sha1":"8d3a4362d0652539757cc8b6df0468130bbae229","sha256":"b40dd7bfe23198f37953a766fa35a394b0bc618a188a99a46f09b873bdf4bc62","sha512":"d0ea56bb3b02d3cbfed8f84ba8cccf710cbfb36db9463b032c15354a4beda700ed26f05b2d7aa215b38c7af9d6b76d273b9c0ff6f32ac15842743d958a5143cd","ssdeep":"384:LwTMXYtfhiys63x8GW1AtcB4wP05M3PPyf6tCgNqDq74NK2QoT0UH4yFHgos:cTMRy8GCAtmnA6tCgNcq74NKkTrNZgos","tlshash":"5682d0e3dbd15b18fd1abe345f535001aa85bab8a86c5f34828bc0187f8c785f61e643","first_seen":"2025-11-13T03:52:08.1269Z","last_seen":"2026-08-22T08:07:47.017016Z","times_seen":7,"resource_available":false,"data":null}},"time_used":166,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":164,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetwin.com/","fqdn":"rainbetwin.com","domain":"rainbetwin.com","tld":"com"},"ip":{"addr":"104.21.93.4","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-22T08:07:13.700Z","timestamp":1787386033700,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetwin.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 21 Aug 2026 06:57:22 GMT","end":"Thu, 19 Nov 2026 07:55:39 GMT"},"fingerprint":{"sha1":"05:0C:1E:EE:15:62:D9:B7:93:8C:10:91:EC:0C:7A:A6:5B:C3:52:CF","sha256":"5F:F9:E5:6A:68:50:D5:77:54:E5:09:13:4F:6D:8E:D2:99:AD:73:FE:B0:04:11:AE:F6:75:E6:89:B8:64:28:5D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rainbetwin.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 308 \r\nserver: cloudflare\r\ndate: Sat, 22 Aug 2026 08:07:14 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://rainbetlegit.com/\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000;\r\ncf-cache-status: DYNAMIC\r\npriority: u=0,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FtYbAEKrCpfKxlD%2Fn83yhJJU9T75qJIlczCQMYp9vKtNlmj4OHKXTo6L9rUttZKTpYY5jjptRvwIzHBPwhwQBoQPhYaHVBTo4d75XDgiELC%2FTcCDmaNekgo8lfrodm4f1Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2f061f6c87edfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"308","status_text":"Permanent Redirect","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T16:26:50.255427Z","times_seen":18038150,"resource_available":true,"data":null}},"time_used":1151,"timings":{"blocked":0,"dns":8,"connect":15,"send":0,"wait":1127,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/fb1e50c6-45db-42ce-93fa-2244a05711cb.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.553Z","timestamp":1787386036553,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/fb1e50c6-45db-42ce-93fa-2244a05711cb.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2314\r\nlast-modified: Wed, 19 Nov 2025 12:52:16 GMT\r\netag: \"691dbd80-90a\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2314,"size_decoded":2657,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f9e70e0a4bc1dfd97eb4e1a28029e4ba","sha1":"0a9b9d28ce85f116dff79468ca118eb9c9d87e47","sha256":"b5aef05c2d335a0d53a69a79c1bf59222ea85435714b5a46a2233c4eb8c536d5","sha512":"b8ed16f84b5fb1abf52103fee6adc1c628ca350071394b3601004dc84b9c7817307641896ffb6047054d67095f04da262ba6e5789b4ff597bb1824a7451ca87e","ssdeep":"","tlshash":"6a412c2743b58b28f58e2db470849b0bd7dd790126836b79f1c4817d07886c2be4a10a","first_seen":"2025-12-08T04:02:28.666378Z","last_seen":"2026-08-22T08:07:47.019759Z","times_seen":20,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":159,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/dist/js/scripts.min.js?v=1.2.5","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.473Z","timestamp":1787386036473,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/dist/js/scripts.min.js?v=1.2.5 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a70f05c-2125\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8485,"size_decoded":3034,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (3531)","md5":"5941c8cb55bde4b2cc24a6ed4ff08f1a","sha1":"6ae966638ac68880e24e46c9d66f4e54b2e902fe","sha256":"6c7214f211a09d913bf9d0ef5a2e420ea78d4275d15bfb6ed07661c12f1f7963","sha512":"489f44ac531a6876ab4220ad32cc9e1b2631767168d4d6b4d123accf36e7ee2bebf861d023494ea3210265ef8b1473893122500c603cceb0cdcd0a78e2bb9562","ssdeep":"192:ajmU5FJoVRReWlAWLAGw9rPBImzgcxh2xYRvGQORa20WGW/dc7yyj/qCho:OFJ+RDAGw9r0hJ7","tlshash":"5602535653b22c7d45736a195e7fae0679b880ab1d83e816380ff4804f784fa43b47e9","first_seen":"2026-05-02T07:09:17.931605Z","last_seen":"2026-08-22T08:07:47.021067Z","times_seen":27,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/74de2455-966c-47c3-84c7-7202b4acd950.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.560Z","timestamp":1787386036560,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/74de2455-966c-47c3-84c7-7202b4acd950.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 1674\r\nlast-modified: Wed, 19 Nov 2025 12:52:19 GMT\r\netag: \"691dbd83-68a\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1674,"size_decoded":2017,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cb744b64324949b5c5d2df2f7b141951","sha1":"b9bca1aad1c94ac40d60fdab1515537c26520184","sha256":"0f5d25b1df3bc12f960ebe7124c82f3b583232dd5d386911b5c1cdec9c82faec","sha512":"82250e10b04aeb461838e53fc1e84faa15e715abd2f56428ebcaf089a80b721c0fc6d349fb3863bab02709761bd7a60bc5141334508f64cca83582bf865a5df6","ssdeep":"","tlshash":"9931d76413b02b0be1527ffe00e35bc6829d1c10c69f9743e71a8a776724ae5298c75e","first_seen":"2025-12-08T04:02:28.60794Z","last_seen":"2026-08-22T08:07:47.021933Z","times_seen":20,"resource_available":false,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":152,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/contact-form-7/includes/swv/js/index.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.469Z","timestamp":1787386036469,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/contact-form-7/includes/swv/js/index.js HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Thu, 11 Sep 2025 10:01:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c29e10-30e0\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12512,"size_decoded":3879,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (12512), with no line terminators","md5":"96e7dc3f0e8559e4a3f3ca40b17ab9c3","sha1":"d363d0291e92c233e828023583dcf6685f2da5a2","sha256":"29fdd17a7002a2e1bbd9b33adafc53457c64006b5aca8f6e4dbf907de35433ca","sha512":"851dcea59510a12dd72c8391a9ea6ffa96bcbe0f009037d7a0b6e27bae63a494709b6eee912b5ed8d25605fbb767a885f543915996f8a8aff34395992e3332dc","ssdeep":"384:wwuf8OQL0sARrAZcNWLq/+Ffm/hibLexa2VautyX2fsL3ZHO1O9H:wwuf8OQL0sAZAGNWmGcibLexa2Vau0XD","tlshash":"d34235e16197e0f0c7c338a48816c051f2bf866cb9898054fb5dcdd22d5de07626b77a","first_seen":"2025-03-11T19:47:45.42406Z","last_seen":"2026-08-22T16:28:13.629197Z","times_seen":230250,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/rainlogo.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.538Z","timestamp":1787386036538,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/rainlogo.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3778\r\nlast-modified: Wed, 19 Nov 2025 12:54:44 GMT\r\netag: \"691dbe14-ec2\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3778,"size_decoded":4121,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b3f1559f7cb6abcbe9a23fc75173c304","sha1":"87b231b2ddbaf4a2cfb71d9bcf0662899d592c65","sha256":"97b00246ef0fe09b6eb39f12cc43179c32c25b0fdb2ceb5bd2a4b7617533709d","sha512":"2ba56e0cf730294aba137e6ccc5b1841e5f7ee1c657acd1416e3a25f4c8cd20f5ca410fbe917b4ea4855b9c111677ec1afa6402a7fe509d308b15f8ad8b0c9b9","ssdeep":"","tlshash":"da713b66b324973df022b5f5016917daea84ac00818bfbf522c441602b38bcc61f8a1e","first_seen":"2025-12-30T02:21:12.811036Z","last_seen":"2026-08-22T08:07:47.023395Z","times_seen":21,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/polylang/fi.png","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.541Z","timestamp":1787386036541,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/polylang/fi.png HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/png\r\ncontent-length: 206\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\netag: \"6a70f05c-ce\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":206,"size_decoded":546,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit colormap, non-interlaced","md5":"89ae87dbe8eba0b4cd4c6b9eba8b6c58","sha1":"528121e83ef10b6d3dbb4e9f074b6e186e2f85e6","sha256":"e8df63258164e8dfc0b438226789c6f910c0748974e47a10e01692db4dce9aa9","sha512":"c4086ba68ec4c3cdf21ace3951bcf439a7e113c584b3c02c8fe93b0551daaa22c9a566b2ac3448272d38c785f02e1db57425b20d64221c57e80037a906842f91","ssdeep":"","tlshash":"fed02296438bad34ed650973e9a7db8dc0b39f8048234707a5abb4a58740643c8f0cd6","first_seen":"2023-08-10T21:26:20Z","last_seen":"2026-08-22T08:07:47.024125Z","times_seen":96,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/rainbetfav-36x36.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.832Z","timestamp":1787386036832,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/rainbetfav-36x36.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv; c2_popup_unique_name=GVgRBVsdH1UdDFAMRVoXBg==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 898\r\nlast-modified: Wed, 19 Nov 2025 12:44:55 GMT\r\netag: \"691dbbc7-382\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":898,"size_decoded":1240,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"de31e0848aea8621fce848599a2f837f","sha1":"3c38f36c3e1e50bf29f15db7399f88debc350701","sha256":"b9aff756ba31a26aa6100d3c928baad608d06924a23ba037f80423bd0667b297","sha512":"04fdb663704c06bd569a9ebbc895e27947192fd3c5d7587f0d45965f32fa0610b89b57bc0c07721a7e6051f721c970ee5280ae530aa578d7182d2b98b1d22277","ssdeep":"","tlshash":"6811203fa3785b5ee0087d7461e91fa2e326ee07c227872a814487a20b244c2f96c187","first_seen":"2025-12-08T04:02:28.610897Z","last_seen":"2026-08-22T08:07:47.025046Z","times_seen":23,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/images/rating/badge-2.svg","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.545Z","timestamp":1787386036545,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/rating/badge-2.svg HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a70f05c-5fe\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1534,"size_decoded":1098,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4a307288943507758d275c24d44b7b8f","sha1":"d448cc20c31b50f716eda30aa040806c162aad94","sha256":"34dc3a35cfb7de60205d9b47f253ae9869f2b590c7cd8a5781af35d1f9b368a7","sha512":"b9df3f2005c9cec2ccfeb85fd04e037e3bbe801d39c7e82da29da3fbf8e7368d789f690ee0dedc474dbf1b1d557d0f13ae14ace045c14b3afcd92efe8a8f03aa","ssdeep":"","tlshash":"0931927ee10d2d2af13886bc9e12c478057abcfa0cc2100045e1b9a7d0a20c60ceae9b","first_seen":"2025-06-05T18:04:56.833392Z","last_seen":"2026-08-22T08:07:47.025614Z","times_seen":79,"resource_available":false,"data":null}},"time_used":166,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":166,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2021/06/twin-casino-1-8.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.550Z","timestamp":1787386036550,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2021/06/twin-casino-1-8.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5326\r\nlast-modified: Thu, 20 Nov 2025 07:06:30 GMT\r\netag: \"691ebdf6-14ce\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5326,"size_decoded":5670,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0b02fa64e12350f2f536c57b6cea25f3","sha1":"c4c88c5fbff5d4a6eee2fcea1102ef2ea35204cb","sha256":"4ce9975b911e4014b94e65dc254592b41e8aa7e93f4616e4b57c41f5479b5a75","sha512":"3466e6be6ffc7eddc46e6689ff19f2d5fdb01264ebe01c71c9477cc8e35aea89b807466f40506bdafd27992ad9b9b7fe1ad1945e1ea04b4403cc6780b9cc8179","ssdeep":"96:BElbw+iXWihNdLftZx4Vd2RPPID3R8SdWyNtw12joNl5Vb1YTksAnJxZAqM3E9L/:swTWih/LDLmDBrdhTiN95YTksAnJjoi/","tlshash":"30b16daa13fcd44ffc7f7538c99d99408d1f5b068345ae064e02d67d6b29096bde8503","first_seen":"2026-07-08T11:54:26.631887Z","last_seen":"2026-08-22T08:07:47.026162Z","times_seen":6,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-600.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.709Z","timestamp":1787386036709,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-600.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19464\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\netag: \"6a70f05c-4c08\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19464,"size_decoded":19809,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19464, version 1.0","md5":"765a7790e9005f066ddfbc939bdd4621","sha1":"c730bde751b462838db69f24c2c94019f964e029","sha256":"3c316558e18d2996ed4394bc36b17d993c21584f30d16dd0e6d87673f5892c18","sha512":"06147c122afcb704457b3a2775d7e375bb7672a47faf8b4743d12b88a784b20af6580882286e2adb0dad9dfd22648e4994e72f54013172680c2c596fc142ed48","ssdeep":"384:7MtxnDHqurSlYJePkNY2PEJrIJpbXHjn8Q3XSPb0W2pphsPwnyuDmsJlbrUM:7c0ukPkjsx2bXz8LTv2bAu6Sl/UM","tlshash":"6392d0bbb4af74f06d03bd33364b1ba1d9da25412cb8981842f7f481a9fbd88e655009","first_seen":"2023-05-04T15:17:50Z","last_seen":"2026-08-22T08:07:47.014051Z","times_seen":199,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/menu-image/includes/css/menu-image.css","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.201Z","timestamp":1787386036201,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/menu-image/includes/css/menu-image.css HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 11 Sep 2025 10:01:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c29df0-d0f\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3343,"size_decoded":1171,"mime_type":"text/css","magic":"ASCII text","md5":"0546e1ffbf7dca6915124f9228e73abe","sha1":"6782f77c395c339354e43260f2976edebe1b25d1","sha256":"75db663f63c3505c2d1d2c41b82da41465bcd39b390516728f7fd323f95f644e","sha512":"08744d582f9c72fdb74dad04593cafacfb692372a58ffd97d78f20ded7966965abe04263a02923925a0e00b14b8c9cbc313d38109fdee4211c4966e74dea518e","ssdeep":"","tlshash":"0f61bac68a6b2432490293a87a8fd3f52b790c239fc6db8477b55918cb49570c2f3275","first_seen":"2023-04-05T15:56:37Z","last_seen":"2026-08-22T12:38:13.824513Z","times_seen":4744,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/10188811-41ab-4cbd-9226-64fbce346b00.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.559Z","timestamp":1787386036559,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/10188811-41ab-4cbd-9226-64fbce346b00.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 1980\r\nlast-modified: Wed, 19 Nov 2025 12:52:24 GMT\r\netag: \"691dbd88-7bc\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1980,"size_decoded":2323,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cba74cea8fe6c59a4d939e2e94615c6b","sha1":"33a5aae92cd699f24df8168e8cc0454a5912c0a7","sha256":"0531737cf8ef31a4669653610977a5529ff633bd38063c7aaf2dd9f4a0033a60","sha512":"ee34165999fb2d0b059472964a7ba8071692cb19153de8c09d81f21d67c25a350c6a20374fbb5adbc8011e1d2628be52af8859e3adc6f982c1a7e22c86332e53","ssdeep":"","tlshash":"9a41e92817a80308fda16bb471d51f56f7e4b53ac6414b4940829f2a2308df87cdc4cf","first_seen":"2025-12-08T04:02:28.616426Z","last_seen":"2026-08-22T08:07:47.027251Z","times_seen":20,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/18.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.561Z","timestamp":1787386036561,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/18.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 1148\r\nlast-modified: Wed, 19 Nov 2025 12:52:17 GMT\r\netag: \"691dbd81-47c\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1148,"size_decoded":1491,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cdc831b6b11226f06fa66ddf16669fa0","sha1":"bc15af299bcf51c7f9799f324cca18f916ee4a70","sha256":"a9acb299047f1409952793a383a1685b151a3fc57a999a9cde69e73198036afc","sha512":"74f9f13a33628f71a2fc92f112f220da14cd129aa183114bdf8d888d22c13579f74ed27f152e2fe4a93044b98b6f207d1dc17551fe2bdec6181585087ec51856","ssdeep":"","tlshash":"5e21652f93156349d90a36f520c42b82eb2d7c399253b6bbd38a03251b04ad6698d0cb","first_seen":"2025-12-08T04:02:28.682592Z","last_seen":"2026-08-22T08:07:47.027766Z","times_seen":21,"resource_available":false,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":152,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-regular.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:17.072Z","timestamp":1787386037072,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-regular.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv; c2_popup_unique_name=GVgRBVsdH1UdDFAMRVoXBg==\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:17 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19396\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\netag: \"6a70f05c-4bc4\"\r\nexpires: Mon, 21 Sep 2026 08:07:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19396,"size_decoded":19741,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19396, version 1.0","md5":"28ab3b0e8151123d4dc1d08197b61f8a","sha1":"7cb91342ce5dbc20a2378b5d5a85dea3f69467ea","sha256":"fbfb7cf0faeba70db28a9ed1a35b932b2a85bac25d27b1859befec067937393f","sha512":"12788bb3cea49ee0b3195d2e0588d7dfdb727a87592cc7772ccca81f4c58d9304f49d45347e9caad96334d451e17e4d4aeae98e1005d463aaf4870e34bc013e1","ssdeep":"384:xb6z6mPqSU/zTjdeJUlq/BJslogLFQ8oga3tkYb4GFD34QXCZigPBc8MU1L:xb6z9SrVil/glooFQ83aCYjSZiQmBGL","tlshash":"9c92d1d5936a5801fb730bf0119a94dbcb83136a0bf4b4e8818cd09bcb5f097417aaf6","first_seen":"2023-05-01T19:05:47Z","last_seen":"2026-08-22T08:07:47.028302Z","times_seen":179,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-700.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:17.077Z","timestamp":1787386037077,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-700.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv; c2_popup_unique_name=GVgRBVsdH1UdDFAMRVoXBg==\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:17 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19768\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\netag: \"6a70f05c-4d38\"\r\nexpires: Mon, 21 Sep 2026 08:07:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19768,"size_decoded":20113,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19768, version 1.0","md5":"8b364bf29bcf08955e8ab90358a8c1cb","sha1":"c8069a4fef1e4643f0454f3b11ae920688a6d121","sha256":"3c3e418bbd1355279dc9a7b5d7a6ff58a73432bd49d6082a0f1544cc1c593e5c","sha512":"7ce04e5001b01d3e4f416f6674d19b76e768fe0f036b1b03fa929af6c430f9d5fb008307e61163b3948ebac0507125cfbd12b49c9419eaa0b82e3693ab7384fd","ssdeep":"384:dA6vMaYevWRWREANJZjjrHqj1aER5RDJZWxHQP73qA03fMtxNjLs:/vMaECpjrwL3XQxHoL0P4xa","tlshash":"c892d09e8d29a0e4da5e5f718ffee6de006fdfb510c5c80c0596f718c805dba941e81a","first_seen":"2023-04-08T13:53:30Z","last_seen":"2026-08-22T08:07:47.02895Z","times_seen":220,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.478Z","timestamp":1787386036478,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Thu, 20 Nov 2025 10:34:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691eeec2-9ec7\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":40647,"size_decoded":10956,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (40647), with no line terminators","md5":"087de03e5dc079a0742ac8478a5f8c87","sha1":"b14ad9cfa3fa6ae9381806189e7f35f543d185ed","sha256":"fe345dc92f2c901c2eccac134294ff2216e70177dd054ba6f104af6015959ee9","sha512":"5742b4c16babac5856080614523b47dff4f3dff7cc102a3a5474ab1e0c82de4a1e987327beb303775042727b35d3f2498f6916c6283117415725dce206c437ef","ssdeep":"768:k4cjy6JZaYSJjv+YfzwLpstNyuGFGgxesKNVhIkYJO2ybEXoHHFC1aRHQpmiVKbX:IZal8OHQpmZNemLECFKAJ","tlshash":"3903e8b93a9c90b416ee87ed37abab48e4303961dc0fc8609565dc542258dc70f9bfb1","first_seen":"2025-10-07T21:11:17.93794Z","last_seen":"2026-08-22T08:07:47.029555Z","times_seen":8301,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/images/icon-arrow-b.svg","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.625Z","timestamp":1787386036625,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/icon-arrow-b.svg HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 223\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\netag: \"6a70f05c-df\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":223,"size_decoded":567,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0a9bbb1c127978be9567884421ca6c6e","sha1":"0cbb80cc31a816566457ce4f7338bad10b1ecbf7","sha256":"ca3ab0f046ee46c65242e6c7ccaac1eb8c4055681e62fdc567547f2c5edf287f","sha512":"c27eaa9710a44a986643c39523c20a2ab664607a26efc600e5deb9e577641fca2042391936bea881f326da3f2ce9607983b3c6bd61e451d3731b4bcbe78e6e61","ssdeep":"","tlshash":"e8d02357530c4d1cb511c620d76d3239847d6143434c519cc5222138571915e7d7fdec","first_seen":"2025-06-17T02:00:31.733848Z","last_seen":"2026-08-22T08:07:47.030113Z","times_seen":78,"resource_available":false,"data":null}},"time_used":145,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":144,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/images/icon-tw.svg","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.628Z","timestamp":1787386036628,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/icon-tw.svg HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a70f05c-4f8\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1272,"size_decoded":1045,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"050a8b972877792f5d38f708b638832b","sha1":"e02fc4068c7b4f4d422983ac1333a5cec53c98cc","sha256":"4abc066cbd2005dc4209be2c2ab5e1eaba41520037e5a54bc8d0416422906305","sha512":"d5920083cd5c67ae65c3d92dde8ba0033db1ccb4b819be08585a3e6ab508468d59530e53d811dbb8fc878426f14ee85fbe507126baa5d1d97ae0e5fa8440210c","ssdeep":"","tlshash":"0f2110e833ec81c45a47c7e1ee362e14796b18fa2f96cb81466456b07e1825c8e5ce74","first_seen":"2025-06-17T02:00:31.759487Z","last_seen":"2026-08-22T08:07:47.03066Z","times_seen":18,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":141,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-regular.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.703Z","timestamp":1787386036703,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-regular.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19396\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\netag: \"6a70f05c-4bc4\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19396,"size_decoded":19741,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19396, version 1.0","md5":"28ab3b0e8151123d4dc1d08197b61f8a","sha1":"7cb91342ce5dbc20a2378b5d5a85dea3f69467ea","sha256":"fbfb7cf0faeba70db28a9ed1a35b932b2a85bac25d27b1859befec067937393f","sha512":"12788bb3cea49ee0b3195d2e0588d7dfdb727a87592cc7772ccca81f4c58d9304f49d45347e9caad96334d451e17e4d4aeae98e1005d463aaf4870e34bc013e1","ssdeep":"384:xb6z6mPqSU/zTjdeJUlq/BJslogLFQ8oga3tkYb4GFD34QXCZigPBc8MU1L:xb6z9SrVil/glooFQ83aCYjSZiQmBGL","tlshash":"9c92d1d5936a5801fb730bf0119a94dbcb83136a0bf4b4e8818cd09bcb5f097417aaf6","first_seen":"2023-05-01T19:05:47Z","last_seen":"2026-08-22T08:07:47.028302Z","times_seen":179,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/dist/styles/styles.min.css","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.450Z","timestamp":1787386036450,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/dist/styles/styles.min.css HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a70f05c-90cf\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37071,"size_decoded":5540,"mime_type":"text/css","magic":"ASCII text","md5":"b4ff3bfe226d51aa7d62c65d9dc21b68","sha1":"feb0060ac2a89a7e6cec259fe4fa2abc6554432a","sha256":"81adf3d9093244663cca03c502058b0131408962a15d9a035609f7908249f3fc","sha512":"9183893095c0cc667e25a3015080ecced33778f4cefc8d49b639875cc053b59945f2942b8606ba193e39bd68a30570d4d8ba0fbe852ad3ef95cb37c762b835fb","ssdeep":"192:/NqClYjXbiLZmBOll/qnewojZ815/t4ssaWZZ+ya76kCaZQF7hoCkiufoSfufTGG:TZs5eoQFlN3svBeb7","tlshash":"9ff222216ab738d9651ff018ef99260621585007f14addf8fedde2886fce29484b1b4f","first_seen":"2025-06-17T02:00:31.753232Z","last_seen":"2026-08-22T08:07:47.031267Z","times_seen":33,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-includes/js/dist/hooks.min.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.466Z","timestamp":1787386036466,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-includes/js/dist/hooks.min.js HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Thu, 20 Aug 2026 05:36:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a86927b-13f3\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5107,"size_decoded":2236,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (5014)","md5":"140ad332a76e011554bcab096a37f4ac","sha1":"72c9da62a624a99da82f8b53ecd2ba8d8e1bca88","sha256":"fc774906082b59dedcfc55b8ef127783b6d056578ff4586a8ebbdb81bbe286f1","sha512":"ccf2833ab9908f740779b84bfd97903f96572aedf6eb0a37f08e51a88f0634e03408bd3e87e2e0586483835a6e09736848e44907848902ef11f8114a21029eca","ssdeep":"96:Fu/16WIHBLusBcADGDd/R5h2RTLlD3jMXY2yGy94E34sTY2CiB:FGIhNBcAD0NRv8XlD3wXY2yH+EoaY2B","tlshash":"4fb163c43542b830e2777027f0ab58d46175abe1a82d8446d59cd8f12da39cee0e7b3d","first_seen":"2026-08-19T23:17:42.247117Z","last_seen":"2026-08-22T16:28:13.6351Z","times_seen":564,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/contact-form-7/includes/js/index.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.472Z","timestamp":1787386036472,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/contact-form-7/includes/js/index.js HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Thu, 11 Sep 2025 10:01:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c29e10-348c\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13452,"size_decoded":4641,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (13452), with no line terminators","md5":"2912c657d0592cc532dff73d0d2ce7bb","sha1":"70a679e2769825236f83bcc56965a9d0bd86c4e9","sha256":"ddcce687729cb358abf9d0d8e1217a097859be2b0d18c23d7c851b38c87bc9c0","sha512":"9646384e65d09bf00cb20365f43e06dd41e7428e3fc6cc2737f4e69b50f006ebb25bd24a566fcd9faec2f0dcb24404e25d57ba7b8c6aba61797a29c515ad5144","ssdeep":"384:IsIRHeFJ1yQ7QdfnJgeYh7MXlsNqrBp1pgQpwOjNtqohIQ/5Z:IsIR+L1yQ7QdpYh7M1iqrBp1pgQpwOjn","tlshash":"0a52d7a1472955321eb506e391e513c1769075aef44b8aa1a898dc2e18bdcc328f3ff7","first_seen":"2024-11-04T17:50:00.022634Z","last_seen":"2026-08-22T16:28:13.586264Z","times_seen":237228,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/images/rating/badge-1.svg","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.543Z","timestamp":1787386036543,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/rating/badge-1.svg HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a70f05c-5fe\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1534,"size_decoded":1098,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"64a832d2a41fe3c9035f305366cd00b0","sha1":"75abbc24c6efd1bf1cf81332b149a7fbf059a609","sha256":"889ee0275f0ebef2da49a348e54930f4e1661afaf111b8f25102aa9352788c0e","sha512":"da758f48497427d11d4f77cab781459a8fd6191731aa1ce2dacd0a0af4c48ba2f265f4b7109bda3f653d1c9eac13d56c93dd05bb963666b4a0e5adaf3eb3c612","ssdeep":"","tlshash":"6131957ea10d2c2af12885bc9e12c4791476bcf70cc2100146e1b9abe0a74c60ceaa5f","first_seen":"2025-06-05T18:04:56.815714Z","last_seen":"2026-08-22T08:07:47.033065Z","times_seen":78,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2021/06/Xon-bet-casino-logo-2.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.546Z","timestamp":1787386036546,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2021/06/Xon-bet-casino-logo-2.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6322\r\nlast-modified: Thu, 20 Nov 2025 07:06:28 GMT\r\netag: \"691ebdf4-18b2\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6322,"size_decoded":6666,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"08339b12a2b42d662884357f41335b17","sha1":"32bb74f51ec062ec9155d76d329babf3e689082b","sha256":"791754c54ae39abd45a6ad27e67d10cb423241108aaeacdf94060668bb697a24","sha512":"e89ad3b7f11387f75373f6b3ebcfdf1ecc4f8d5cbb7c6aa6f3f2519685ab1528447b3c8ead46aa0474e9c646e0d2434867eca0c4c1ea6a5b913ee19fea50f5d2","ssdeep":"192:ywTxnRybUXJ9bvf8cUuN/ucz8oaymWP6W3h:ywTfX3vf4joaEPZ","tlshash":"2fd19ebb9781f5aaf218a4b1d5917178d6c25512950a1f8fe1fc024eefb1c832d3da30","first_seen":"2026-07-22T10:08:06.634109Z","last_seen":"2026-08-22T08:07:47.03362Z","times_seen":5,"resource_available":false,"data":null}},"time_used":167,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/lars-round.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.552Z","timestamp":1787386036552,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/lars-round.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 118940\r\nlast-modified: Wed, 19 Nov 2025 13:59:19 GMT\r\netag: \"691dcd37-1d09c\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":118940,"size_decoded":119287,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"79bfe13483fbf7c54201a4355bab3721","sha1":"31e8ce19eb3963eac0b504090517439166b725eb","sha256":"db6dff5ef9ec0b81c6931542259f617b98590354b0e8e75ba8db6e17d260c779","sha512":"ec71b9e8512a0b98822762df1d44dbb77a44c51b691a2716ed2d53bffa31436cf8bd372b337def725989f4923f5a5f65a94a4c54937cc88f2df4fb9391c21e1a","ssdeep":"3072:CMiYnGS3Ss1NwHXKVe6f71bzui1eacrqDG:1/LCs1a3Pqdp1eE6","tlshash":"2ac312dca601a16d51fe9561388f656db3ed62b62838138b033d53b3d7b8034586fabc","first_seen":"2026-07-22T10:08:06.652665Z","last_seen":"2026-08-22T08:07:47.034197Z","times_seen":5,"resource_available":false,"data":null}},"time_used":219,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":59,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/61c01ace-3a1a-43f2-b564-f37e55a17ad6.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.554Z","timestamp":1787386036554,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/61c01ace-3a1a-43f2-b564-f37e55a17ad6.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2336\r\nlast-modified: Wed, 19 Nov 2025 12:52:18 GMT\r\netag: \"691dbd82-920\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2336,"size_decoded":2679,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f111f7ef53193e4da6880e13be80733c","sha1":"ec8caef1631e4f0b6f02e83c4913b7c908771425","sha256":"2700c2db71cf9307807a9e85fc2f8d85b0bed6970414f626ac569ab4f3fbefc2","sha512":"ab9ee5d79f8b5e6cb4902376e281a5992f07b2ed60481b489cdde28820dfde3f4367bcb6b8cac2581c9d97b5244d6a1b5ec2b0469b0f82a9331882a9ae283cd8","ssdeep":"","tlshash":"c441e92153550b1af95f1bf022a16f10eaf1bd75d3416e199243438357a02cd795f5cf","first_seen":"2025-12-08T04:02:28.680985Z","last_seen":"2026-08-22T08:07:47.034836Z","times_seen":20,"resource_available":false,"data":null}},"time_used":161,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":158,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-700.woff2","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.707Z","timestamp":1787386036707,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-700.woff2 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19768\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\netag: \"6a70f05c-4d38\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19768,"size_decoded":20113,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19768, version 1.0","md5":"8b364bf29bcf08955e8ab90358a8c1cb","sha1":"c8069a4fef1e4643f0454f3b11ae920688a6d121","sha256":"3c3e418bbd1355279dc9a7b5d7a6ff58a73432bd49d6082a0f1544cc1c593e5c","sha512":"7ce04e5001b01d3e4f416f6674d19b76e768fe0f036b1b03fa929af6c430f9d5fb008307e61163b3948ebac0507125cfbd12b49c9419eaa0b82e3693ab7384fd","ssdeep":"384:dA6vMaYevWRWREANJZjjrHqj1aER5RDJZWxHQP73qA03fMtxNjLs:/vMaECpjrwL3XQxHoL0P4xa","tlshash":"c892d09e8d29a0e4da5e5f718ffee6de006fdfb510c5c80c0596f718c805dba941e81a","first_seen":"2023-04-08T13:53:30Z","last_seen":"2026-08-22T08:07:47.02895Z","times_seen":220,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/complianz/css/banner-1-optin.css?v=3229","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.768Z","timestamp":1787386036768,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/complianz/css/banner-1-optin.css?v=3229 HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv; c2_popup_unique_name=GVgRBVsdH1UdDFAMRVoXBg==\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 14 Jul 2026 08:24:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a55f240-3d9f\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15775,"size_decoded":3269,"mime_type":"text/css","magic":"ASCII text, with very long lines (15775), with no line terminators","md5":"8459c5e5511a771d2c2cbf9348bb7973","sha1":"8dc74efddc3780b8dd10bb82fed470fef8e6c610","sha256":"fd66f68d1b1e1d38e81f3a978e8d767727cb7ea51b80b157192d8255e2c764f6","sha512":"2bd85caee2f1156edfcd0ee2c435dd26935e80795465e88343a2abace2809afde4d25b5187824da75eca8a97fa3f26b68a5a18c5f20fdae7b107396d778710af","ssdeep":"96:su9ppeDJjeWeyne6nxZ1csUi5p8Z1cAvqlIWurrkTobudlYLhf8Iqb56qlym6OoE:f0EpVAWDi5cWi2IWRzZbZ3sMBd","tlshash":"626231a99e0c1164e6dfdf1c3baa860e9114f731b29d1af824a17850f2fe5d11d2e387","first_seen":"2026-01-27T02:45:53.071064Z","last_seen":"2026-08-22T08:07:47.035416Z","times_seen":9,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/rainbetfav-300x300.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.830Z","timestamp":1787386036830,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/rainbetfav-300x300.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nCookie: pll_language=sv; c2_popup_unique_name=GVgRBVsdH1UdDFAMRVoXBg==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3768\r\nlast-modified: Wed, 19 Nov 2025 12:44:55 GMT\r\netag: \"691dbbc7-eb8\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3768,"size_decoded":4111,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7ecd14b4037aab18af49c0c24bd43d97","sha1":"34174cb594165b8aa92fa4fd28114a00ef779f8e","sha256":"b47701b3befdef1d213d351741c2f7ef6a4c88d3a26854f041b760f46c94be29","sha512":"03b0c1ac961caedba30c69b8b85267e8de2568e13a02599b3ea0dbe1bc456fa137e0997359ff13fd3c154df378331d7fa11f985443b429fa5df0d677ece25ed8","ssdeep":"","tlshash":"38717eb517376779c6701eb4e06036e2ebd07517ca023566a0280eba03407c17d7f5bd","first_seen":"2025-12-08T04:02:28.687932Z","last_seen":"2026-08-22T08:07:47.035986Z","times_seen":23,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/themes/aviator/dist/js/header-search-logic.js","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.476Z","timestamp":1787386036476,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/themes/aviator/dist/js/header-search-logic.js HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 984\r\nlast-modified: Mon, 03 Aug 2026 19:47:40 GMT\r\netag: \"6a70f05c-3d8\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":984,"size_decoded":1353,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"95a9aec3eec3385f61adaccf426e2fd3","sha1":"67e44e58f75a4514ba008c2ee3d5dcfd307c2a75","sha256":"52cd79f5c766b41f3be8b2c592ffa11eb63d657ea8c77b8d2be5875a2f98abe8","sha512":"a78a430b4249582e89a6da526bf80eec5e11991c0c780e248e53c3acb9b315b60bdd03082eeb146fd9d218cf61952ab5408afa40adba8081e03d1dfee3cca148","ssdeep":"","tlshash":"7511b4396128b439923b01c7d266afd53d59008ff840427966ac47ee2fc1ce3a3625fa","first_seen":"2025-06-17T02:00:31.74037Z","last_seen":"2026-08-22T08:07:47.03664Z","times_seen":63,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2021/06/lukki-casino-8.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.548Z","timestamp":1787386036548,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2021/06/lukki-casino-8.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4418\r\nlast-modified: Thu, 20 Nov 2025 07:06:29 GMT\r\netag: \"691ebdf5-1142\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4418,"size_decoded":4762,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d01b3e09ac6a68bf4ddd5088eeece361","sha1":"bc6eb050ea932e43f3c03c6dde7a584b9545b7b5","sha256":"d9db133b5472ada60b4553b9b14628cbb581b4aa8d9040806980bf3e74e47cdd","sha512":"d5024135988eb1fe6d7343af4b185a87a3bdccdec270cdb5c02be82dd856bcb9db604ea4e2d70131e6381ed321d99905a9c27909e6c4b5d92d4302d9a6314db2","ssdeep":"96:TElbw+iXtIRGmci3vpvaJmkrL9Bu1ROoSD86pOvBVeKlginBdCrbFzN:OwTCUmci/BaJ1XSFVFLBYPf","tlshash":"05915d1e97a6d382eb216ffce1902356a3157d31c2857d3145e9672b8300ee42f59e2b","first_seen":"2025-11-13T03:52:08.129441Z","last_seen":"2026-08-22T08:07:47.037237Z","times_seen":19,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/786f77e6-02a2-4626-9846-d040bdd0f0f3.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.555Z","timestamp":1787386036555,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/786f77e6-02a2-4626-9846-d040bdd0f0f3.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2688\r\nlast-modified: Wed, 19 Nov 2025 12:52:20 GMT\r\netag: \"691dbd84-a80\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2688,"size_decoded":3031,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7bff080ce05d05842cbcb6fc373b3b0a","sha1":"a2239c4cc79de821a32ba099da91d2c5b1e454c4","sha256":"b7c7d1c41967de68e44a7f13795390b6e4f4deed1c26b467b00f944c47e41f12","sha512":"bc141f9eb06557930908f03a75464ae3c8ca755fb762bf28d4172dd149fda5e262ddfb19f67c6d9191235888cfcc22cb0b17d9102f40ba21b7ca3f6e2a1de866","ssdeep":"","tlshash":"ce51d6def376a259f12525b8a0d00bc3eba43d16875e8936e2d544368f382c63c8d296","first_seen":"2025-12-08T04:02:28.612551Z","last_seen":"2026-08-22T08:07:47.037847Z","times_seen":20,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":157,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2021/06/Logo-black-2-scaled-1.png","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.544Z","timestamp":1787386036544,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2021/06/Logo-black-2-scaled-1.png HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/png\r\ncontent-length: 909914\r\nlast-modified: Tue, 24 Mar 2026 07:09:17 GMT\r\netag: \"69c2389d-de25a\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":909914,"size_decoded":910260,"mime_type":"image/png","magic":"PNG image data, 1920 x 899, 8-bit/color RGBA, non-interlaced","md5":"b3bcb5b0d94334e40d30d4a44989683a","sha1":"554b65a0805b826a382bbfec6096aea148f8c5ff","sha256":"396d74d76903c267505c595019830cc6d5767ae5467fc3694bcb60de47182522","sha512":"99901c1895cf24de52b7764488e60d78b35763b0ab2967270a154d972091b27c941d384900d5980856990d1fdd6ba1c8f0fdaca80dbd55d9f491299ef4024159","ssdeep":"24576:dphbV0zQBHeUrynrWlcyRjEOTMllKJviAo:dncQB+UOalZoOTM7KJv5o","tlshash":"e21523148abcef4ff8a6c58616a13889f7d026d0ebd6e2d6bc05f4a4b1576033f405ad","first_seen":"2026-07-22T10:08:06.631599Z","last_seen":"2026-08-22T08:07:47.038444Z","times_seen":5,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":172,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2021/06/verde-casino-7.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.551Z","timestamp":1787386036551,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2021/06/verde-casino-7.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8482\r\nlast-modified: Thu, 20 Nov 2025 07:06:30 GMT\r\netag: \"691ebdf6-2122\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8482,"size_decoded":8826,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2d6a1157713c25ce590e5a8a300baee6","sha1":"98673846b415a3fdc76102e8e4c54d433a776f11","sha256":"ac2934ad6ecaea312e4e5b9d065671c303a6992a57437fa9c6bab420c328cbcc","sha512":"42b5a87101eac27104609554a450851a5ffbdeadf9292af29bfec98d4d71e65c511bf1a84ddf8816d083fa707da12de4d7f9a5c80ca3514e6ce70e2312e9d7f1","ssdeep":"192:9wTXUbR4NwXWOo06k7OF0zkg+YXOvW4awmmV2yTWtmakKko:9wTXeRgOP6wOF04gRx4TmzyTGkK/","tlshash":"30029e22a34d927af1591bf644b02b05c72d52124b9f233ea3564f998b2cd5b4dec2cf","first_seen":"2025-11-13T03:52:08.150516Z","last_seen":"2026-08-22T08:07:47.039028Z","times_seen":9,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":161,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/complianz-gdpr/assets/css/cookieblocker.min.css","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.207Z","timestamp":1787386036207,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/complianz-gdpr/assets/css/cookieblocker.min.css HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 20 Nov 2025 10:34:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"691eeec2-ade\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2782,"size_decoded":1069,"mime_type":"text/css","magic":"ASCII text, with very long lines (2782), with no line terminators","md5":"182c31e4b049004a343781556afe8606","sha1":"d37c351aeeadbb654d441621b611bed8d7104aa1","sha256":"afe6634c4de97ea6dd0824fa7ad34f551b6faede0ca95db78516165ab1610f47","sha512":"cbfdfc6c97bb4fc1be24576e61c6accedb203bb5b38054393256ae354851d6beb91bd3afac2d7e5bea7729b3aeb28579dedb848b344f7ee592228fabe7ffa7fc","ssdeep":"","tlshash":"305129756d931890b3feef052d80b9842a29f753c02e0dede162962cb1df586cde6345","first_seen":"2025-03-07T16:44:09.983719Z","last_seen":"2026-08-22T15:13:32.288191Z","times_seen":33185,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/simpletoc/assets/accordion.css","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.451Z","timestamp":1787386036451,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/simpletoc/assets/accordion.css HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 03 Apr 2024 22:09:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"660dd398-403\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1027,"size_decoded":809,"mime_type":"text/css","magic":"ASCII text","md5":"7e46c6d521d06fec54ccbe595100711e","sha1":"f07cba2f0f32a53e7b8b1f2064a45c16c73e7269","sha256":"a33079577d26f8a8906e24b3c3cf041b3f792f560802715514cf24e6bd4fede6","sha512":"be8bdb655cace77565a89bccab6c4b3c67694b691e7200894797f3246e2434dbe4091917d680c64e289c1fd28c9fc97fcad4eb9eaeca719149578e246a39ade0","ssdeep":"","tlshash":"3311cb1d23443583632eb19a9683e7759a0f4586ab8c0d9a31c4357c7288adc2b77aec","first_seen":"2025-06-17T02:00:31.820186Z","last_seen":"2026-08-22T08:07:47.040312Z","times_seen":67,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/plugins/polylang-pro/vendor/wpsyntex/polylang/flags/se.png","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.540Z","timestamp":1787386036540,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/plugins/polylang-pro/vendor/wpsyntex/polylang/flags/se.png HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/png\r\ncontent-length: 248\r\nlast-modified: Wed, 22 Apr 2026 08:54:41 GMT\r\netag: \"69e88cd1-f8\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":248,"size_decoded":588,"mime_type":"image/png","magic":"PNG image data, 16 x 11, 8-bit colormap, non-interlaced","md5":"af9b2179cbd6982c86ee0fe0c2d812bb","sha1":"ce02f96449a23b4128f687ba002510c982728189","sha256":"3ad72d04b863fc860a2f724f27820ad7b2699614a91dcd4c0bdd06f57685ec75","sha512":"bbc7447444cd2f1a907ea4a34e0b8560fa7daa5a3688d0f6e378def91156b8253fc7117567d60d6f52fad07e675cb5a42270c56005b2c82535d8abc5c43884f1","ssdeep":"","tlshash":"bed02ba7319228b8ee3ba1278840c123ad5a0a2484f12a070c04f35a6c8006c4405b80","first_seen":"2023-06-16T18:14:04Z","last_seen":"2026-08-22T08:07:47.04096Z","times_seen":84,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g10102301085.co/gr?id=-Nx8NDCxoi5XHExf6J3e\u0026refurl=\u0026winurl=https%3A%2F%2Frainbetlegit.com%2F","fqdn":"g10102301085.co","domain":"g10102301085.co","tld":"co"},"ip":{"addr":"34.120.31.228","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.564Z","timestamp":1787386036564,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g9508048080.co","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Tue, 07 Jul 2026 23:47:34 GMT","end":"Tue, 06 Oct 2026 00:41:06 GMT"},"fingerprint":{"sha1":"33:85:DA:27:B6:E8:23:41:7B:FC:54:07:F6:E6:0C:F7:14:8B:79:09","sha256":"20:2E:77:9F:D3:C2:12:6D:43:BA:E7:23:70:C5:CD:D1:2C:F0:B8:C4:D9:42:EA:A4:B6:AB:24:B0:98:11:19:A1"}}},"request":{"raw":"GET /gr?id=-Nx8NDCxoi5XHExf6J3e\u0026refurl=\u0026winurl=https%3A%2F%2Frainbetlegit.com%2F HTTP/1.1\r\nHost: g10102301085.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-powered-by: Express\r\ncontent-type: application/javascript; charset=utf-8\r\ncache-control: private, no-cache, no-store, must-revalidate\r\netag: W/\"160-9XoKTHJPhkwR+uq3SOUaam5YNgk\"\r\nvary: Accept-Encoding\r\nx-cloud-trace-context: aa3d06d8ea70576f36ad682bcb1efe61\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\nserver: Google Frontend\r\ncontent-length: 352\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Google Cloud Load Balancing","description":"Google Cloud Load Balancing is a scalable, fully managed global load balancing service using Google Frontend.","website":"https://cloud.google.com/load-balancing","common_platform_enumeration":"","icon":"Google Cloud.svg","categories":["Load balancers"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":352,"size_decoded":779,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (352), with no line terminators","md5":"76c7778e369c280777c7d8889a9a8e85","sha1":"f57a0a4c724f864c11faeab748e51a6a6e583609","sha256":"c5048d5003cbdfc61ecbba655e914de5c09f349d0d85306ef23f5e34e7e3acb3","sha512":"1fcdf37f78b33db612bc9f4159c8148e77bbf0e97b2b6b9f069fe738730e186bf3fed0d5b51bd9c90880d6bda7195416a2ed9dc02487ad202c3dd29ec508bf8d","ssdeep":"","tlshash":"70e026e8b6ea613050f766ac2212c42138736032334c18ebe860236a7ef011e811a7ff","first_seen":"2025-08-13T16:04:47.939696Z","last_seen":"2026-08-22T08:07:47.041544Z","times_seen":34,"resource_available":true,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":4,"connect":14,"send":0,"wait":56,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetlegit.com/wp-content/uploads/2025/11/rainwinbg.webp","fqdn":"rainbetlegit.com","domain":"rainbetlegit.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetlegit.com/","date":"2026-08-22T08:07:16.623Z","timestamp":1787386036623,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetlegit.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 05:55:45 GMT","end":"Tue, 20 Oct 2026 05:55:44 GMT"},"fingerprint":{"sha1":"76:03:36:19:B7:01:89:E9:D7:AE:37:37:A8:4A:EB:8D:F2:EE:65:B4","sha256":"2F:D6:AF:5C:4A:65:E6:7F:3F:BC:BA:A4:D2:C6:1C:82:CB:E7:0C:03:1A:19:CD:12:69:07:D8:1E:33:A1:10:81"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/rainwinbg.webp HTTP/1.1\r\nHost: rainbetlegit.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetlegit.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 22 Aug 2026 08:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 139742\r\nlast-modified: Wed, 19 Nov 2025 13:13:38 GMT\r\netag: \"691dc282-221de\"\r\nexpires: Mon, 21 Sep 2026 08:07:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":139742,"size_decoded":140089,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"81e60c25115e2d74da01a33324a42407","sha1":"d58a23dace2eb44cf648f9fa6c058687eaa1f714","sha256":"d72cfd84569876d63286ba1b26298463b7ddc8bdede5418493f60f94c9eaebba","sha512":"f77a88d00116ef973610a9cfc48e10dad07400a83b8a823bda8694a5c118f1b3a3aeb70df290476c0b7eb241cf7912efee55be9c6db96127ef26bc6408e646ae","ssdeep":"3072:ngSoqhwMamA6b4d5cwpywlwWlXojL1BM4v1z5zakVuu:nnogfam5opyTWlYj5d5Uksu","tlshash":"ddd3126818219e78c93466773db41bf2b55152141a563aeb9580aff4ef45ffecc80383","first_seen":"2026-07-22T10:08:06.644334Z","last_seen":"2026-08-22T08:07:47.04224Z","times_seen":5,"resource_available":false,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":145,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-22","alert":"Sinkholed","trigger":"rainbetlegit.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}