{"report_id":"ca56c459-ed37-4dca-a74a-d03a9b317d0f","version":0,"status":"done","tags":[],"date":"2026-08-31T07:47:11Z","url":{"schema":"http","addr":"au-rainbets.com/","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":0,"asn":0,"as":"","country":"Romania","country_code":"RO"},"final":{"url":{"schema":"https","addr":"au-rainbets.com/","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"title":"Rainbet Australia | Official Crypto Casino and Sports Online","dom":{"size":144586,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (15770)","md5":"5a54a682d8fcff1a2165e3fb26b47035","sha1":"3ae3f37ca1aff55e5317b4976a171963a2d957ab","sha256":"1f0e6711dd801d79fe8ab41ee03172fd52f1b2716bff6b01185417048ec61529","sha512":"dd12dd41b7a1fc2daa4e1891d7ccdb97b2eae3d044e0d72e30561c5247549e181452b1221e21231532443894583c2b086d3c6423a8d42ac2df05f7c7ba51dd62","ssdeep":"768:BEBYH+b0EO8CEhtg5TXXyr4ZEXGSgr+Yc9bBH075BzT3UQjnU25d1Uh1jVH4YMDx:yGkCEhtgStXtgrr2MUQPYL4ag2otr9","tlshash":"0ee3a57f1249602f76732add7c547b09a02d915eca00c6e4baeec1c86bc2f91563f99c","dom_hash":"domhash2460d864b886b7a4beaa4f875b3d6b34","first_seen":"2026-08-31T07:40:54.348837Z","last_seen":"2026-08-31T07:47:12.865396Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"au-rainbets.com/","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":0,"asn":0,"as":"","country":"Romania","country_code":"RO"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-05T07:47:11Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"au-rainbets.com","ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"domain_registered":"2026-06-30","domain_rank":0,"first_seen":"2026-08-31T07:40:50.171392Z","last_seen":"2026-08-31T07:40:50.171392Z","alert_count":56,"request_count":28,"received_data":581547,"sent_data":15866,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"au-rainbets.com/","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"2bf50de73e80be90907f9d063ab4dc13","sha1":"cf9ff1f3b50e0bcb3c579cf3be2bb90fa2c4c841","sha256":"d2282bff21607221d029139d4da81e21974fd6611ef1ae6cacffa2586753dd12","sha512":"6f556cf39dac1806d4cee11ef05aaeec8601d6c62885f80bfd5001cbb727360992f5fc5b0a87e62acb8255436f45fdce7897fa4cda747ce6c0038a6bd4b35039","ssdeep":"","tlshash":"0fd0c9757f24bab001f9612a267fea60097a54c2e041650476354c596e78888338ae3a","size":210,"data":"","first_seen":"2026-01-03T20:40:12.132526Z","last_seen":"2026-09-08T10:01:49.589378Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"7f664e7250425ccb6915f2908e1245c5","sha1":"6fa0f252c35fdd87cb308781a3a91e8d86348d17","sha256":"def81363db9d4366d5b1b74f68d4b48b903e5e92373a2cb9b77479f174fa7f7b","sha512":"1c6550d9b82175705de83b2a108c1c21f24cffa4d3732a404b38426a683e374aed8129aba69747c81d946220ecf058af6bd63b635702bca1ac2842da130114c0","ssdeep":"","tlshash":"08214d2c6535b566021f807632ff45f9653f29ce7f409eb27c2c40909ee8889376657d","size":1364,"data":"","first_seen":"2026-01-03T20:40:12.130051Z","last_seen":"2026-09-08T10:01:49.587844Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"ef03e272320335bf92db4ff69a2dc1b8","sha1":"cf26234f8e78aba61617113679c4b0a40cf37e02","sha256":"23b30ed5e6fa8bc8e50e8cf6934135bf132337557738332276cdb416c97ca6a7","sha512":"568928933116f4abea25e0c8edf757e9c981f6707fa11b5594709fbe4663e63ee18452cf8aff51a5cc445471c315ccc56f713a21cdaf2d830fc6d8453fabdcd8","ssdeep":"","tlshash":"0631d0347361797147af4cf420da1b946f3750963905c8b2ed6dcc5a6d81e460871dfe","size":1633,"data":"","first_seen":"2026-08-31T07:40:54.417625Z","last_seen":"2026-08-31T07:47:12.883604Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"04a9b59b7e49f913a3926f6431334155","sha1":"35f2521d3ab3f75895b02da9c6b5419e1a35be59","sha256":"94c4eed60653e14337c021261a52581e9b6f93ae9ba512912ca30ce656b3ac64","sha512":"40068c8ae55d5f7b8bdd0fcf5eabdf443cd6b033788c1686b0a96adf4f645bfd34d50ea7f0017c9514e3029752b213826373450e791760bf8310e0c303aaa750","ssdeep":"","tlshash":"57a0028530a76805c505d1605967fc00446415cb818eaa181ae5ee30e515598748232e","size":58,"data":"","first_seen":"2023-03-07T12:09:28Z","last_seen":"2026-09-08T19:37:00.460322Z","times_seen":19226,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"2892d8e1a7b3036d0a381ad275da2810","sha1":"e2449711e0edd776690271935be96c4f0bad69f1","sha256":"c384ea74a78d136347c54f1e4dd12d141d10113ce61ef15a815073871bd4de76","sha512":"80372e35d509dad35c728444aa28ab7ed4859df90c2656e35cdb571a372498be14175c02e9e71287848959ac406ef6630b61489c741243a1ac1322e31433ee6d","ssdeep":"","tlshash":"1fb0126d16408a0c6461d3c9175c3230341455174c276357edd440402ba81a8c40c456","size":98,"data":"","first_seen":"2026-08-31T07:40:54.420917Z","last_seen":"2026-08-31T07:47:12.884887Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"a1eb88910fa4f47f750898b64468b54e","sha1":"e7cbdf34b0a2e5ad0e212595b641dad1b99eed5e","sha256":"30f359e25dddac630f1afef589b07a1b38b8d97b08cd86b0f7eac1f325019387","sha512":"7e3c5ae54ef04c3373c355c4fddd5e7bbc2525f05a07f35279ce1b62b18aa79840f4f78dd1ae72413586e9cf7b6d451cd68fde37120d8844a406abd6f4d87de1","ssdeep":"","tlshash":"41b0122a4ea12b0fb1c02ac12c206267421851795940dd003673d1401604b414d4c444","size":87,"data":"","first_seen":"2026-08-31T07:40:54.423615Z","last_seen":"2026-08-31T07:47:12.885603Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"f814583f7a6942b8374197e227e52662","sha1":"e72d859bd076bd99d70947c328d43214e8898db5","sha256":"3b0b3553fac48b013f02975f1d9b9c163d1010e47775bcf8158dd7ef5f52fb7f","sha512":"128e7f3c831f30ee186376b768d62cedbbee83e3b48d3e6b0e7562393ccd0055bbb35c4479063c481a0b6a6ffb3089465425de4aa60d1b434e3f5ab98a9dab63","ssdeep":"","tlshash":"b9e0abeb7b500872829f742f116eb3893e724033f9007e05e078c8a26cf4d4000a2d5f","size":413,"data":"","first_seen":"2026-05-19T22:55:05.229344Z","last_seen":"2026-09-08T10:01:49.583868Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"0a4d682d4d60e33ea2e683285185d977","sha1":"ce9bc4439b7befc76d5abeb28fbf03ca68f490fb","sha256":"2f10a9d6e55ce202b8ace73896a1420ba29eb5f814f050f78da23f898d7c8c77","sha512":"ec304ab4e14ffc034b2a537fc5b7caf7f5c973b8845f718a9aeb35d6bd413c4c460e159b942b2b603b22f4517cdf9ecdd8c989abfc4243d64e408a12d07e5b8f","ssdeep":"","tlshash":"51112613b6002872d8ff2a7fb956524c3b21a151b8206468892daa2c1672fc251babcd","size":1000,"data":"","first_seen":"2026-07-22T10:11:53.034693Z","last_seen":"2026-09-08T10:01:49.589948Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"7d72b80690ba108f701c1b1a5e697720","sha1":"befbf4e1dec83cfd6b3a327a909be07a4f8ab490","sha256":"0d8bef99a34b9446ad386668c9742d804417dad6f930213a1dd1cbb8dacbd6e3","sha512":"7cc76f2ee11c4395caa4a50a63bbd1668733e4f8ba3d89189a8014364a7e93873434b7b7b7c7ab37f624d4558e064d913657c064dcc9b35f892a0f05e0991130","ssdeep":"192:q6e4j3qVXlu798fbuEO4C5/hsNs35PhSkzISM8Z:bel29YFts/Swau","tlshash":"62f153497542b57f393b7071d0af220b313970a3a84b4861e9b8f6d87c789792a23d7d","size":8109,"data":"","first_seen":"2025-07-25T05:28:04.240916Z","last_seen":"2026-09-08T19:37:00.408168Z","times_seen":29738,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/js/1bd4d6826d42530cff1f52e1f192e7ff.js?ver=2e7ff","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"84da02f41d9c61dec95f05d41236d497","sha1":"2bb978916e29e01050ea71d2c68a299fc61f90d3","sha256":"9d8c33c2fb6efb6c3e9778edd19c6c60bf61e327c1132787e14f66cb7cba9726","sha512":"8fb2072d48ed3c279ea005d758d64467384ff0efa72e5ffbe547dda86a6cdd3aa28741a2d342ca28d9e98cb8ee8a0c8d05fad75455d47eb858d7f4101b81e40c","ssdeep":"384:IsIRHeFJ1yQ7QdfnJgeYh7MXlsNqrBp1pgQpwOjNtqohIQ/5D:IsIR+L1yQ7QdpYh7M1iqrBp1pgQpwOjZ","tlshash":"ab52d7a1472955321eb506e391e513c1769075aef44b8aa1a898dc2e18bdcc328f3ff7","size":13453,"data":"","first_seen":"2024-11-03T23:01:56.192803Z","last_seen":"2026-09-08T18:35:53.961657Z","times_seen":10595,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/js/7dba6fb7ee5926c162986a95bb54289f.js?ver=97e1a","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"34b7a3157a5046401828fc341eb29c5c","sha1":"23603180b6ad2cf5dc2ce3861a89983044c77f0b","sha256":"c8c144eb75af7fa8a84918141c548a3cbd90d242bb092cd81abe71b2550b5394","sha512":"177fe6a87afa1b5ac5f3e92ec021c97306eddc81e68590a13782c2619c7a7e4e54fbe421283d1cc9ec5ea8832d8e467c5451aa0f3e932e1bc767fe1d85d4421f","ssdeep":"192:lmPfv8AViGaWFIkwvbOHzdIr469nyIKzgcxh2xDaM2DbnJ8:lM8miGdx9zd04698ny","tlshash":"96d1a7a563917cbe04f60e466c3eaf97bdbd84bd6d83e115600bfc885c784d343806aa","size":6635,"data":"","first_seen":"2026-08-07T08:55:41.891018Z","last_seen":"2026-08-31T07:47:12.880786Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/js/cb2d59959e87106f53fcf3fbf8a75bf0.js?ver=75bf0","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"3e71574fc61389daf15e9585bcc93fe5","sha1":"92394cddb2ae40c7060c709621db86634b25fe1a","sha256":"2f441c962e351ef150f80bda82823c79cbb9ca057e0be5761a3584a3ba89b9e6","sha512":"028551afde3dd00b87ebd86e58888da9a3c317753760af83697602d9796956e687f83e5b1d60e3844d6f9b6acfcbb9cf93088116a6872e72ea6c2fafec85c50f","ssdeep":"384:wwuf8OQL0sARrAZcNWLq/+Ffm/hibLexa2VautyX2fsL3ZHO1O95:wwuf8OQL0sAZAGNWmGcibLexa2Vau0XN","tlshash":"9c4235e16197e0f0c7c338a48816c051f2bf866cb8898054fb5dcdd22d5de07626b77a","size":12513,"data":"","first_seen":"2025-03-17T01:59:03.5715Z","last_seen":"2026-09-08T18:35:53.928915Z","times_seen":10317,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/js/95423c31ddcc93021bc11cbdf1c3ccde.js?ver=3ccde","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"d486693396667295dbac8def9ad05a91","sha1":"06b384bd770972d0e17e628e36151e8a85225b35","sha256":"b9bbbb9b2abd510cf3167f5405655cf4c639546eda301b56ec6457f8a716d6a4","sha512":"00f71aab782c0ffffc746840f8877d5f19930d12e88db66ad7a8745e27bc90fd6f35feaeb173880625c98ffefca04e0ada16b3cd96a95b7e96476b60f501a923","ssdeep":"96:oE7/RPgrMs4WLJOmlWS33c0xyE2B1596NiH826V0NG7CXMGOyd/sEomkKvYCGaM/:Xhgws4WTBYNB1C9aNwAMPyd0R3SGaMSe","tlshash":"50c1a8c979def056235910a594afb005e134be2870deb800aae0c4957eb44cdb1b7fba","size":5792,"data":"","first_seen":"2026-08-20T20:36:42.924411Z","last_seen":"2026-09-08T18:35:53.95861Z","times_seen":177,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/js/3cdb6d3b5efe83735558aeca6f37adf0.js?ver=7adf0","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"586bfcf8b3829616f51a7e2a4aead287","sha1":"fb73b0adb250de47d067b2b2caf78879c68571b6","sha256":"57d5f320624e13606b8e6dc357482e85842aac712a80ddb4bbb0787fb1a3e803","sha512":"0b8e1125be8714dffc0e08ff49fbbbb1304c738e3d020bb2404b66ccc1f954ad6125760a58853aa42b02e1cee7fbec9c0d42623e1d529aee35f47851d267e648","ssdeep":"96:Fu/16WIHBLusBcADGDd/R5h2RTLlD3jMXY2yGy94E34sTY2Cio:FGIhNBcAD0NRv8XlD3wXY2yH+EoaY2o","tlshash":"abb163c43542b830e2777027f0ab58d46175abe1a82d8446d59cd8f12da39cee0e7b3d","size":5108,"data":"","first_seen":"2026-08-20T20:36:42.900883Z","last_seen":"2026-09-08T18:35:53.974751Z","times_seen":181,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/js/b2a8e5e64576b1179b754eabc9208056.js?ver=08056","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"2d17ff7d4e8d5e41a20e4dac14b07b15","sha1":"e74917f84a8202b5cc9b8642e2c0088e372b5e9a","sha256":"543e5870a5655323e29de36a3d6874be298bfe89d3c2ccdd376f53f612f68175","sha512":"79a8d0f06e598faa6be3d0923982ee8621468b31568b2839222e0532b445210f0ecf44047458ad6cc595c1ee4733b33fe06b94f2219c7f6722762b543eb3b901","ssdeep":"","tlshash":"ca11e9316128b839853a01c7d26a6fe57d5914ceb80001b466bc56bd2ed0ce3a3725fa","size":861,"data":"","first_seen":"2026-05-19T22:55:05.220654Z","last_seen":"2026-09-08T10:01:49.545878Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/js/e7a905479527d22ad30aa76516a24d38.js?ver=24d38","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"3e8341fada8147ca242bc7c7fb6812b2","sha1":"a5b9d2e4e86d3ba38d1fb919e6daed232fa2cb8f","sha256":"54966181112bb716b04c3a3dc88a09b2af4e3993cc4667b1e82493fb0e0d033e","sha512":"1f901244d947471f661be0969849a9b0da2d9d09bd4c00172c5a8d08f31092d34fc97f66074828a84ca87b8f5c3166820b72291b2f35839cb01a5d3c54df4fd6","ssdeep":"","tlshash":"0af0e9b4259112328bd4c95a95463691b9195155f242a0db1d284ccc28cde8524fb7bb","size":493,"data":"","first_seen":"2026-07-15T03:20:27.035981Z","last_seen":"2026-09-08T10:01:49.558497Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"[LiteSpeed] Start Lazy Load","filename":"https://au-rainbets.com/","line_number":333,"column_number":7870}]},"http":[{"url":{"schema":"https","addr":"au-rainbets.com/","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-31T07:46:38.681Z","timestamp":1788162398681,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:41 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nlink: \u003chttps://au-rainbets.com/wp-json/\u003e; rel=\"https://api.w.org/\", \u003chttps://au-rainbets.com/wp-json/wp/v2/pages/2\u003e; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\", \u003chttps://au-rainbets.com/\u003e; rel=shortlink\r\nx-litespeed-tag: 114_front,114_URL.6666cd76f96956469e7be39d750cc7d9,114_F,114_Po.2,114_PGS,114_,114_UCSS.79ca5cd8c2afccf79c8ea2d824eab1b7,114_MIN.ab0a83db389e6d799af3a5c7df613f2d.css\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":146871,"size_decoded":29116,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (15829)","md5":"a479d84dd0f971bf5d053db16020ed49","sha1":"4a26d68f862640cb6e2fc1abe51df16983fc5a6a","sha256":"5e664cca172bdbd9e826262fea6d1e54b9180dce7efb5a402f3c592506823b3b","sha512":"c2a9541d604bd15db7363c7a309cac6532f3f6a6ac1526666e5cca5f467e3052ac22dcbc83912a19d8e6fadb7e119dc6cfc05890cf86c52bd0308c06ffb7b86f","ssdeep":"768:1EBMH+b0EW8iXuujgaY8JIrCvpzEwGkwW+YF6hqI07zlHcaijnU25d1Uh1jVH4YY:eCaiXVjgjCvSwTwWraeiPYL4ag2otrP","tlshash":"a7e3947f1249602f76772adc7c547b0da02d915eca00c6e4baeec1c86bc2f91563e99c","first_seen":"2026-08-31T07:47:12.86664Z","last_seen":"2026-08-31T07:47:12.86664Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3172,"timings":{"blocked":-1,"dns":67,"connect":57,"send":0,"wait":2982,"receive":0,"ssl":66},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/js/cb2d59959e87106f53fcf3fbf8a75bf0.js?ver=75bf0","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.094Z","timestamp":1788162402094,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/litespeed/js/cb2d59959e87106f53fcf3fbf8a75bf0.js?ver=75bf0 HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 31 Aug 2026 07:46:41 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a953161-30e1\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12513,"size_decoded":3882,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (12511)","md5":"3e71574fc61389daf15e9585bcc93fe5","sha1":"92394cddb2ae40c7060c709621db86634b25fe1a","sha256":"2f441c962e351ef150f80bda82823c79cbb9ca057e0be5761a3584a3ba89b9e6","sha512":"028551afde3dd00b87ebd86e58888da9a3c317753760af83697602d9796956e687f83e5b1d60e3844d6f9b6acfcbb9cf93088116a6872e72ea6c2fafec85c50f","ssdeep":"384:wwuf8OQL0sARrAZcNWLq/+Ffm/hibLexa2VautyX2fsL3ZHO1O95:wwuf8OQL0sAZAGNWmGcibLexa2Vau0XN","tlshash":"9c4235e16197e0f0c7c338a48816c051f2bf866cb8898054fb5dcdd22d5de07626b77a","first_seen":"2025-03-17T01:59:03.5715Z","last_seen":"2026-09-08T18:35:53.928915Z","times_seen":10317,"resource_available":true,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":100,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-600.woff2","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.445Z","timestamp":1788162402445,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-600.woff2 HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/wp-content/litespeed/css/ab0a83db389e6d799af3a5c7df613f2d.css?ver=a668f\r\nCookie: fc_popup_unique_name=CkxVGVgRBVsdH0pWCFYV\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19464\r\nlast-modified: Sun, 30 Aug 2026 10:46:45 GMT\r\netag: \"6a940a15-4c08\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19464,"size_decoded":19809,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19464, version 1.0","md5":"765a7790e9005f066ddfbc939bdd4621","sha1":"c730bde751b462838db69f24c2c94019f964e029","sha256":"3c316558e18d2996ed4394bc36b17d993c21584f30d16dd0e6d87673f5892c18","sha512":"06147c122afcb704457b3a2775d7e375bb7672a47faf8b4743d12b88a784b20af6580882286e2adb0dad9dfd22648e4994e72f54013172680c2c596fc142ed48","ssdeep":"384:7MtxnDHqurSlYJePkNY2PEJrIJpbXHjn8Q3XSPb0W2pphsPwnyuDmsJlbrUM:7c0ukPkjsx2bXz8LTv2bAu6Sl/UM","tlshash":"6392d0bbb4af74f06d03bd33364b1ba1d9da25412cb8981842f7f481a9fbd88e655009","first_seen":"2023-05-04T15:17:50Z","last_seen":"2026-09-08T10:01:49.569499Z","times_seen":204,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/js/e7a905479527d22ad30aa76516a24d38.js?ver=24d38","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.100Z","timestamp":1788162402100,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/litespeed/js/e7a905479527d22ad30aa76516a24d38.js?ver=24d38 HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 493\r\nlast-modified: Mon, 31 Aug 2026 07:46:41 GMT\r\netag: \"6a953161-1ed\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":493,"size_decoded":862,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (491)","md5":"3e8341fada8147ca242bc7c7fb6812b2","sha1":"a5b9d2e4e86d3ba38d1fb919e6daed232fa2cb8f","sha256":"54966181112bb716b04c3a3dc88a09b2af4e3993cc4667b1e82493fb0e0d033e","sha512":"1f901244d947471f661be0969849a9b0da2d9d09bd4c00172c5a8d08f31092d34fc97f66074828a84ca87b8f5c3166820b72291b2f35839cb01a5d3c54df4fd6","ssdeep":"","tlshash":"0af0e9b4259112328bd4c95a95463691b9195155f242a0db1d284ccc28cde8524fb7bb","first_seen":"2026-07-15T03:20:27.035981Z","last_seen":"2026-09-08T10:01:49.558497Z","times_seen":11,"resource_available":true,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-700.woff2","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.314Z","timestamp":1788162402314,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-700.woff2 HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/wp-content/litespeed/css/ab0a83db389e6d799af3a5c7df613f2d.css?ver=a668f\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19768\r\nlast-modified: Sun, 30 Aug 2026 10:46:45 GMT\r\netag: \"6a940a15-4d38\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19768,"size_decoded":20113,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19768, version 1.0","md5":"8b364bf29bcf08955e8ab90358a8c1cb","sha1":"c8069a4fef1e4643f0454f3b11ae920688a6d121","sha256":"3c3e418bbd1355279dc9a7b5d7a6ff58a73432bd49d6082a0f1544cc1c593e5c","sha512":"7ce04e5001b01d3e4f416f6674d19b76e768fe0f036b1b03fa929af6c430f9d5fb008307e61163b3948ebac0507125cfbd12b49c9419eaa0b82e3693ab7384fd","ssdeep":"384:dA6vMaYevWRWREANJZjjrHqj1aER5RDJZWxHQP73qA03fMtxNjLs:/vMaECpjrwL3XQxHoL0P4xa","tlshash":"c892d09e8d29a0e4da5e5f718ffee6de006fdfb510c5c80c0596f718c805dba941e81a","first_seen":"2023-04-08T13:53:30Z","last_seen":"2026-09-08T10:01:49.568491Z","times_seen":228,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/uploads/2025/11/cropped-rainbet-32x32.webp","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.416Z","timestamp":1788162402416,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/cropped-rainbet-32x32.webp HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 262\r\nlast-modified: Mon, 03 Nov 2025 08:34:47 GMT\r\netag: \"69086927-106\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":262,"size_decoded":604,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 32x32, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"18a04ca2fc1411aeb3d243d557b8fb88","sha1":"31e054aca101decb47c0ec3a8a255ba24130e997","sha256":"1d00d95c985aafa49d6f8edff1cd5a4f2052760dc8baf0924b9a52b248443de4","sha512":"f1c235b516a8d104942dc53b94f63729960277ee632b31d7deb6a942d3df3d478ca4735e60a9a06a24b037987301bd7a6eefa6b4eafd6d5d8f2179f537e7c020","ssdeep":"","tlshash":"e5d0eb0ec06093a0a8a11d000e2eaaac304a282194c9b062c6da8b3480840b0392b260","first_seen":"2026-08-07T08:55:41.903115Z","last_seen":"2026-08-31T07:47:12.870658Z","times_seen":4,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/uploads/2021/06/casinolab_logo-13.webp","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.588Z","timestamp":1788162402588,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/uploads/2021/06/casinolab_logo-13.webp HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nCookie: fc_popup_unique_name=CkxVGVgRBVsdH0pWCFYV\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 30128\r\nlast-modified: Fri, 07 Nov 2025 12:04:09 GMT\r\netag: \"690de039-75b0\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":30128,"size_decoded":30473,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f96f3d28d31c4cfd5521879427fede45","sha1":"dd1bc6fcf4b27472349d0c9637e0b2b696d24c55","sha256":"a9324ce9d167e8e77c331afe020c97bea593e51f0fe1ac9220e43b053878b30a","sha512":"ed165fc2c53ce01f5b6654bb7523f33903d8d21d2a680dd5137e84f1709a1296197baf6027ec53d5af104cad52d560ebe1b1330c9877cbab89dddc5b91f553b2","ssdeep":"768:yT7djYZUOfDc2+6VAtID6XtOlp38Ti3RoiK:GylDM8AtI2dWH3T","tlshash":"a3d2d09676b500bff23c013cda198ef2b5303a896c0274a6e1937399527d8ce973127b","first_seen":"2025-11-13T03:52:08.190132Z","last_seen":"2026-08-31T07:47:12.871213Z","times_seen":16,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-500.woff2","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.442Z","timestamp":1788162402442,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-500.woff2 HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/wp-content/litespeed/css/ab0a83db389e6d799af3a5c7df613f2d.css?ver=a668f\r\nCookie: fc_popup_unique_name=CkxVGVgRBVsdH0pWCFYV\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19580\r\nlast-modified: Sun, 30 Aug 2026 10:46:45 GMT\r\netag: \"6a940a15-4c7c\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19580,"size_decoded":19925,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19580, version 1.0","md5":"95c5b525d84aaf5a8411f6ae51916cfe","sha1":"426515e1c6be3e3b101c0c79f29741ea57cdb0ec","sha256":"01ffc8802167df3b7c029549092fd0aa9f0712e089ef4e26c543376de69faa91","sha512":"24907cb28e09ebc62f256916b1a104a53f53b4b284c78380ce450efde9081772bab7b1772dccc7c464e9be21ebd2ee8e023046714a047fd1973b68969bc90685","ssdeep":"384:q2wsotK+EWugFk5Ab1n1sHQySPOqTJ7BsARD5Wzxy7ZlcU+jXzauPc9m:GzlE6r0wtsALhjuWuYm","tlshash":"af92e1217443c4c9ee3d98f24e4fdf3481b8de1d097e21592ed24283ebe57449a3e945","first_seen":"2023-05-01T05:27:13Z","last_seen":"2026-09-08T10:01:49.574286Z","times_seen":213,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-700.woff2","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.443Z","timestamp":1788162402443,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-700.woff2 HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/wp-content/litespeed/css/ab0a83db389e6d799af3a5c7df613f2d.css?ver=a668f\r\nCookie: fc_popup_unique_name=CkxVGVgRBVsdH0pWCFYV\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19768\r\nlast-modified: Sun, 30 Aug 2026 10:46:45 GMT\r\netag: \"6a940a15-4d38\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19768,"size_decoded":20113,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19768, version 1.0","md5":"8b364bf29bcf08955e8ab90358a8c1cb","sha1":"c8069a4fef1e4643f0454f3b11ae920688a6d121","sha256":"3c3e418bbd1355279dc9a7b5d7a6ff58a73432bd49d6082a0f1544cc1c593e5c","sha512":"7ce04e5001b01d3e4f416f6674d19b76e768fe0f036b1b03fa929af6c430f9d5fb008307e61163b3948ebac0507125cfbd12b49c9419eaa0b82e3693ab7384fd","ssdeep":"384:dA6vMaYevWRWREANJZjjrHqj1aER5RDJZWxHQP73qA03fMtxNjLs:/vMaECpjrwL3XQxHoL0P4xa","tlshash":"c892d09e8d29a0e4da5e5f718ffee6de006fdfb510c5c80c0596f718c805dba941e81a","first_seen":"2023-04-08T13:53:30Z","last_seen":"2026-09-08T10:01:49.568491Z","times_seen":228,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/themes/aviator/images/rating/badge-1.svg","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.581Z","timestamp":1788162402581,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/rating/badge-1.svg HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nCookie: fc_popup_unique_name=CkxVGVgRBVsdH0pWCFYV\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Sun, 30 Aug 2026 10:46:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a940a15-5fe\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1534,"size_decoded":1098,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"64a832d2a41fe3c9035f305366cd00b0","sha1":"75abbc24c6efd1bf1cf81332b149a7fbf059a609","sha256":"889ee0275f0ebef2da49a348e54930f4e1661afaf111b8f25102aa9352788c0e","sha512":"da758f48497427d11d4f77cab781459a8fd6191731aa1ce2dacd0a0af4c48ba2f265f4b7109bda3f653d1c9eac13d56c93dd05bb963666b4a0e5adaf3eb3c612","ssdeep":"","tlshash":"6131957ea10d2c2af12885bc9e12c4791476bcf70cc2100146e1b9abe0a74c60ceaa5f","first_seen":"2025-06-05T18:04:56.815714Z","last_seen":"2026-09-08T10:01:49.552489Z","times_seen":87,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/uploads/2021/06/bitcasino-1.webp","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.582Z","timestamp":1788162402582,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/uploads/2021/06/bitcasino-1.webp HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nCookie: fc_popup_unique_name=CkxVGVgRBVsdH0pWCFYV\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9362\r\nlast-modified: Thu, 28 May 2026 09:04:32 GMT\r\netag: \"6a180520-2492\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9362,"size_decoded":9706,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"45a64830863bb1449740b85506033954","sha1":"6111a0f2ff0065526011b3590319f53af7a20c09","sha256":"bacf01696063546164a3da9649124e604d5cbd2042cbf5e7d3b0f6ba6caaf2a9","sha512":"d21a90e35a3b41b29e2f635df7315c85f630c83971fb8469e500dcf5ba7cb77a31694ee9fb46d20ed421a8ab4cd37c2f58566523365f1578b6eafe3f0e503038","ssdeep":"192:KwHm25hWrorAic9ZU8wg1ja1t4U4txUFqQBn6RXTbAX+6/YRk0QxLFXV:KwGyQ+AiMa8zaHynUAmF+6gRyxZl","tlshash":"de12bf85d708cf0ef2e748ff26d4dbc5e168de04fbe9da11a2811a134b378a90d98083","first_seen":"2026-05-02T07:09:18.092445Z","last_seen":"2026-09-05T09:49:21.434919Z","times_seen":27,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/css/ab0a83db389e6d799af3a5c7df613f2d.css?ver=a668f","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.084Z","timestamp":1788162402084,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/litespeed/css/ab0a83db389e6d799af3a5c7df613f2d.css?ver=a668f HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 25 Aug 2026 13:22:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a8d96fa-281e3\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":164323,"size_decoded":55967,"mime_type":"text/css","magic":"ASCII text, with very long lines (25397)","md5":"ab0a83db389e6d799af3a5c7df613f2d","sha1":"1c8d17de7150533f0aedef852b1a564c722d6bb0","sha256":"cad60b6766432e01660087f60ec2bb35d348f4c3f6086be5a7cfb3fb986c115a","sha512":"584dc02bf13835a9c75c9fa7b443a20762e3e3aac047891e0160e46e91d6bca3c3603a4f753a4061cba06551bd3b8da6b59d2ce8702a9d59407ac6d13bd38fb8","ssdeep":"1536:PCDHNKkQYzx/ZvB/qPWMiquqioMUXQSJYIMW+sJP54ze7KcU6:2xttBE1MUU9W+K4zkKcX","tlshash":"7cf30a65a34420ec732be66aefc07279206df515e9019efdf49bd01c49ca6a201faf1d","first_seen":"2026-08-31T07:40:54.385907Z","last_seen":"2026-08-31T07:47:12.873353Z","times_seen":2,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/js/95423c31ddcc93021bc11cbdf1c3ccde.js?ver=3ccde","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.092Z","timestamp":1788162402092,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/litespeed/js/95423c31ddcc93021bc11cbdf1c3ccde.js?ver=3ccde HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 31 Aug 2026 07:46:41 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a953161-16a0\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5792,"size_decoded":2869,"mime_type":"application/javascript; charset=utf-8","magic":"data","md5":"d486693396667295dbac8def9ad05a91","sha1":"06b384bd770972d0e17e628e36151e8a85225b35","sha256":"b9bbbb9b2abd510cf3167f5405655cf4c639546eda301b56ec6457f8a716d6a4","sha512":"00f71aab782c0ffffc746840f8877d5f19930d12e88db66ad7a8745e27bc90fd6f35feaeb173880625c98ffefca04e0ada16b3cd96a95b7e96476b60f501a923","ssdeep":"96:oE7/RPgrMs4WLJOmlWS33c0xyE2B1596NiH826V0NG7CXMGOyd/sEomkKvYCGaM/:Xhgws4WTBYNB1C9aNwAMPyd0R3SGaMSe","tlshash":"50c1a8c979def056235910a594afb005e134be2870deb800aae0c4957eb44cdb1b7fba","first_seen":"2026-08-20T20:36:42.924411Z","last_seen":"2026-09-08T18:35:53.95861Z","times_seen":177,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/uploads/2025/11/cropped-rainbet-192x192.webp","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.415Z","timestamp":1788162402415,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/uploads/2025/11/cropped-rainbet-192x192.webp HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 1442\r\nlast-modified: Mon, 03 Nov 2025 08:34:47 GMT\r\netag: \"69086927-5a2\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1442,"size_decoded":1785,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 192x192, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"cb55c15d3d2c2ae2ac356c01dc8b510d","sha1":"0c24c69aa495e80a846ae51b83b25cde2582c00e","sha256":"fe5574d630de2ea7330ba47e5740d9fa5d96629d0df87a128d9282570d74dfd9","sha512":"bf06f416e4e949b5bdde3c49a7d31fb5d7fb1e4b066dfcdf89222b5cd9d2733419ab8981ff6c90aa013086ae8eb3531b8bc70bd52a27d229f52b2e934f32f0f0","ssdeep":"","tlshash":"af21c9da99916ee8fdc8e8046c6c454defe52140966444cc6a5a096c6dcf47c740581d","first_seen":"2026-08-07T08:55:41.893561Z","last_seen":"2026-08-31T07:47:12.874573Z","times_seen":4,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/uploads/2026/07/rainbet_logo-1.webp","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.579Z","timestamp":1788162402579,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/rainbet_logo-1.webp HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nCookie: fc_popup_unique_name=CkxVGVgRBVsdH0pWCFYV\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8912\r\nlast-modified: Wed, 08 Jul 2026 12:10:05 GMT\r\netag: \"6a4e3e1d-22d0\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8912,"size_decoded":9256,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"50a986f01111363eeba08778a4ff586a","sha1":"196a47bb332ef16b51b2bb864dcd15b0b0469931","sha256":"25324b8dd37c42c54be379505840c7fbd684c4d43787b9cfdd24730b68518423","sha512":"890ec5531364a25d795c933ea81b8543cf353a6fda5cbdae8f5f388a21e1c245fd4bb71d4723642605863ebe2a0335155232e5f73153263ecda4e4b5477b5ab6","ssdeep":"192:7jOJyHnVDDyfxsPsatWS5IJ1/l4vrWxpNk2paUvelwAJ6S7TFIqU:7aA9yJqc/8ripXptvelwAJ/W","tlshash":"4a029ed2956f28c2fdad9d39de2052e5723c6ac445f20f510368a9b28dd22c8aacd553","first_seen":"2026-07-08T12:06:19.255246Z","last_seen":"2026-08-31T07:47:12.875262Z","times_seen":5,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/themes/aviator/images/icon-arrow-b.svg","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.238Z","timestamp":1788162402238,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/icon-arrow-b.svg HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/wp-content/litespeed/css/ab0a83db389e6d799af3a5c7df613f2d.css?ver=a668f\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 223\r\nlast-modified: Sun, 30 Aug 2026 10:46:45 GMT\r\netag: \"6a940a15-df\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":223,"size_decoded":567,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0a9bbb1c127978be9567884421ca6c6e","sha1":"0cbb80cc31a816566457ce4f7338bad10b1ecbf7","sha256":"ca3ab0f046ee46c65242e6c7ccaac1eb8c4055681e62fdc567547f2c5edf287f","sha512":"c27eaa9710a44a986643c39523c20a2ab664607a26efc600e5deb9e577641fca2042391936bea881f326da3f2ce9607983b3c6bd61e451d3731b4bcbe78e6e61","ssdeep":"","tlshash":"e8d02357530c4d1cb511c620d76d3239847d6143434c519cc5222138571915e7d7fdec","first_seen":"2025-06-17T02:00:31.733848Z","last_seen":"2026-09-08T10:01:49.571796Z","times_seen":82,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/js/3cdb6d3b5efe83735558aeca6f37adf0.js?ver=7adf0","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.090Z","timestamp":1788162402090,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/litespeed/js/3cdb6d3b5efe83735558aeca6f37adf0.js?ver=7adf0 HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 31 Aug 2026 07:46:41 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a953161-13f4\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5108,"size_decoded":2236,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (5014)","md5":"586bfcf8b3829616f51a7e2a4aead287","sha1":"fb73b0adb250de47d067b2b2caf78879c68571b6","sha256":"57d5f320624e13606b8e6dc357482e85842aac712a80ddb4bbb0787fb1a3e803","sha512":"0b8e1125be8714dffc0e08ff49fbbbb1304c738e3d020bb2404b66ccc1f954ad6125760a58853aa42b02e1cee7fbec9c0d42623e1d529aee35f47851d267e648","ssdeep":"96:Fu/16WIHBLusBcADGDd/R5h2RTLlD3jMXY2yGy94E34sTY2Cio:FGIhNBcAD0NRv8XlD3wXY2yH+EoaY2o","tlshash":"abb163c43542b830e2777027f0ab58d46175abe1a82d8446d59cd8f12da39cee0e7b3d","first_seen":"2026-08-20T20:36:42.900883Z","last_seen":"2026-09-08T18:35:53.974751Z","times_seen":181,"resource_available":true,"data":null}},"time_used":103,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":103,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/themes/aviator/images/star-icon.svg","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.242Z","timestamp":1788162402242,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/star-icon.svg HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/wp-content/litespeed/css/ab0a83db389e6d799af3a5c7df613f2d.css?ver=a668f\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 282\r\nlast-modified: Sun, 30 Aug 2026 10:46:45 GMT\r\netag: \"6a940a15-11a\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":282,"size_decoded":627,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"47d7d44c0e7cba35b9903fcf5056c2b0","sha1":"7396eebf4cd6481f68577c7ed618da3848c7dcf5","sha256":"e1b89f9939709042aeb824ac851db5b411a542f91f50d143d118f7f1b331897a","sha512":"477b9212fe22b98d53eb7b11c3d1f2382f042c4c534a0db74ac721edba0783a71ba546cc1035889b3998ebef7a658bbe24ce3a7c8abc32e5816d08ebb7a496d1","ssdeep":"","tlshash":"ffd02bfa50ace9064044c724337a6c3d31e730be08de110d69c2f1a1e5794d72e2c9d8","first_seen":"2025-06-17T02:00:31.751022Z","last_seen":"2026-08-31T07:47:12.87684Z","times_seen":142,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-regular.woff2","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.311Z","timestamp":1788162402311,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-regular.woff2 HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/wp-content/litespeed/css/ab0a83db389e6d799af3a5c7df613f2d.css?ver=a668f\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19396\r\nlast-modified: Sun, 30 Aug 2026 10:46:45 GMT\r\netag: \"6a940a15-4bc4\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19396,"size_decoded":19741,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19396, version 1.0","md5":"28ab3b0e8151123d4dc1d08197b61f8a","sha1":"7cb91342ce5dbc20a2378b5d5a85dea3f69467ea","sha256":"fbfb7cf0faeba70db28a9ed1a35b932b2a85bac25d27b1859befec067937393f","sha512":"12788bb3cea49ee0b3195d2e0588d7dfdb727a87592cc7772ccca81f4c58d9304f49d45347e9caad96334d451e17e4d4aeae98e1005d463aaf4870e34bc013e1","ssdeep":"384:xb6z6mPqSU/zTjdeJUlq/BJslogLFQ8oga3tkYb4GFD34QXCZigPBc8MU1L:xb6z9SrVil/glooFQ83aCYjSZiQmBGL","tlshash":"9c92d1d5936a5801fb730bf0119a94dbcb83136a0bf4b4e8818cd09bcb5f097417aaf6","first_seen":"2023-05-01T19:05:47Z","last_seen":"2026-09-08T10:01:49.566695Z","times_seen":187,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-600.woff2","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.315Z","timestamp":1788162402315,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-600.woff2 HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/wp-content/litespeed/css/ab0a83db389e6d799af3a5c7df613f2d.css?ver=a668f\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19464\r\nlast-modified: Sun, 30 Aug 2026 10:46:45 GMT\r\netag: \"6a940a15-4c08\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19464,"size_decoded":19809,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19464, version 1.0","md5":"765a7790e9005f066ddfbc939bdd4621","sha1":"c730bde751b462838db69f24c2c94019f964e029","sha256":"3c316558e18d2996ed4394bc36b17d993c21584f30d16dd0e6d87673f5892c18","sha512":"06147c122afcb704457b3a2775d7e375bb7672a47faf8b4743d12b88a784b20af6580882286e2adb0dad9dfd22648e4994e72f54013172680c2c596fc142ed48","ssdeep":"384:7MtxnDHqurSlYJePkNY2PEJrIJpbXHjn8Q3XSPb0W2pphsPwnyuDmsJlbrUM:7c0ukPkjsx2bXz8LTv2bAu6Sl/UM","tlshash":"6392d0bbb4af74f06d03bd33364b1ba1d9da25412cb8981842f7f481a9fbd88e655009","first_seen":"2023-05-04T15:17:50Z","last_seen":"2026-09-08T10:01:49.569499Z","times_seen":204,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-regular.woff2","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.439Z","timestamp":1788162402439,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-regular.woff2 HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/wp-content/litespeed/css/ab0a83db389e6d799af3a5c7df613f2d.css?ver=a668f\r\nCookie: fc_popup_unique_name=CkxVGVgRBVsdH0pWCFYV\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19396\r\nlast-modified: Sun, 30 Aug 2026 10:46:45 GMT\r\netag: \"6a940a15-4bc4\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19396,"size_decoded":19741,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19396, version 1.0","md5":"28ab3b0e8151123d4dc1d08197b61f8a","sha1":"7cb91342ce5dbc20a2378b5d5a85dea3f69467ea","sha256":"fbfb7cf0faeba70db28a9ed1a35b932b2a85bac25d27b1859befec067937393f","sha512":"12788bb3cea49ee0b3195d2e0588d7dfdb727a87592cc7772ccca81f4c58d9304f49d45347e9caad96334d451e17e4d4aeae98e1005d463aaf4870e34bc013e1","ssdeep":"384:xb6z6mPqSU/zTjdeJUlq/BJslogLFQ8oga3tkYb4GFD34QXCZigPBc8MU1L:xb6z9SrVil/glooFQ83aCYjSZiQmBGL","tlshash":"9c92d1d5936a5801fb730bf0119a94dbcb83136a0bf4b4e8818cd09bcb5f097417aaf6","first_seen":"2023-05-01T19:05:47Z","last_seen":"2026-09-08T10:01:49.566695Z","times_seen":187,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/themes/aviator/images/rating/badge-2.svg","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.583Z","timestamp":1788162402583,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/rating/badge-2.svg HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nCookie: fc_popup_unique_name=CkxVGVgRBVsdH0pWCFYV\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Sun, 30 Aug 2026 10:46:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a940a15-5fe\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1534,"size_decoded":1098,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4a307288943507758d275c24d44b7b8f","sha1":"d448cc20c31b50f716eda30aa040806c162aad94","sha256":"34dc3a35cfb7de60205d9b47f253ae9869f2b590c7cd8a5781af35d1f9b368a7","sha512":"b9df3f2005c9cec2ccfeb85fd04e037e3bbe801d39c7e82da29da3fbf8e7368d789f690ee0dedc474dbf1b1d557d0f13ae14ace045c14b3afcd92efe8a8f03aa","ssdeep":"","tlshash":"0931927ee10d2d2af13886bc9e12c478057abcfa0cc2100045e1b9a7d0a20c60ceae9b","first_seen":"2025-06-05T18:04:56.833392Z","last_seen":"2026-09-08T10:01:49.539337Z","times_seen":88,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/themes/aviator/images/rating/badge-3.svg","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.696Z","timestamp":1788162402696,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/themes/aviator/images/rating/badge-3.svg HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nCookie: fc_popup_unique_name=CkxVGVgRBVsdH0pWCFYV\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Sun, 30 Aug 2026 10:46:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a940a15-5fe\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1534,"size_decoded":1099,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7eeee2de42abcacbff2a6c7bf5a657cc","sha1":"51a3fb1504d7b7e0e33aa5726eeb44afc3bb71d5","sha256":"27c33f3c5feaa8d2e46c4825da890fdc4c413b92c15832715497f617668f9ac6","sha512":"1be718acc70ef82173c17393f61186cb71ef7ad5cbcc77e479846d73c067063e7b9eff8239cfe111b3828655f3f966170677a6e998bc1a8f5d2335a1087ff559","ssdeep":"","tlshash":"5631877ea20d2d7af12885bc9e12d479147abcf74cc3000145e1f9a7d4a60c61cfae9b","first_seen":"2025-06-05T18:04:56.837162Z","last_seen":"2026-09-08T10:01:49.559099Z","times_seen":79,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/js/1bd4d6826d42530cff1f52e1f192e7ff.js?ver=2e7ff","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.096Z","timestamp":1788162402096,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/litespeed/js/1bd4d6826d42530cff1f52e1f192e7ff.js?ver=2e7ff HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 31 Aug 2026 07:46:41 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a953161-348d\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13453,"size_decoded":4645,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (13451)","md5":"84da02f41d9c61dec95f05d41236d497","sha1":"2bb978916e29e01050ea71d2c68a299fc61f90d3","sha256":"9d8c33c2fb6efb6c3e9778edd19c6c60bf61e327c1132787e14f66cb7cba9726","sha512":"8fb2072d48ed3c279ea005d758d64467384ff0efa72e5ffbe547dda86a6cdd3aa28741a2d342ca28d9e98cb8ee8a0c8d05fad75455d47eb858d7f4101b81e40c","ssdeep":"384:IsIRHeFJ1yQ7QdfnJgeYh7MXlsNqrBp1pgQpwOjNtqohIQ/5D:IsIR+L1yQ7QdpYh7M1iqrBp1pgQpwOjZ","tlshash":"ab52d7a1472955321eb506e391e513c1769075aef44b8aa1a898dc2e18bdcc328f3ff7","first_seen":"2024-11-03T23:01:56.192803Z","last_seen":"2026-09-08T18:35:53.961657Z","times_seen":10595,"resource_available":true,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/js/b2a8e5e64576b1179b754eabc9208056.js?ver=08056","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.099Z","timestamp":1788162402099,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/litespeed/js/b2a8e5e64576b1179b754eabc9208056.js?ver=08056 HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 861\r\nlast-modified: Mon, 31 Aug 2026 07:46:41 GMT\r\netag: \"6a953161-35d\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":861,"size_decoded":1230,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (306)","md5":"2d17ff7d4e8d5e41a20e4dac14b07b15","sha1":"e74917f84a8202b5cc9b8642e2c0088e372b5e9a","sha256":"543e5870a5655323e29de36a3d6874be298bfe89d3c2ccdd376f53f612f68175","sha512":"79a8d0f06e598faa6be3d0923982ee8621468b31568b2839222e0532b445210f0ecf44047458ad6cc595c1ee4733b33fe06b94f2219c7f6722762b543eb3b901","ssdeep":"","tlshash":"ca11e9316128b839853a01c7d26a6fe57d5914ceb80001b466bc56bd2ed0ce3a3725fa","first_seen":"2026-05-19T22:55:05.220654Z","last_seen":"2026-09-08T10:01:49.545878Z","times_seen":13,"resource_available":true,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-500.woff2","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.312Z","timestamp":1788162402312,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/themes/aviator/fonts/montserrat-v25-latin-ext_latin-500.woff2 HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/wp-content/litespeed/css/ab0a83db389e6d799af3a5c7df613f2d.css?ver=a668f\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 19580\r\nlast-modified: Sun, 30 Aug 2026 10:46:45 GMT\r\netag: \"6a940a15-4c7c\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19580,"size_decoded":19925,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 19580, version 1.0","md5":"95c5b525d84aaf5a8411f6ae51916cfe","sha1":"426515e1c6be3e3b101c0c79f29741ea57cdb0ec","sha256":"01ffc8802167df3b7c029549092fd0aa9f0712e089ef4e26c543376de69faa91","sha512":"24907cb28e09ebc62f256916b1a104a53f53b4b284c78380ce450efde9081772bab7b1772dccc7c464e9be21ebd2ee8e023046714a047fd1973b68969bc90685","ssdeep":"384:q2wsotK+EWugFk5Ab1n1sHQySPOqTJ7BsARD5Wzxy7ZlcU+jXzauPc9m:GzlE6r0wtsALhjuWuYm","tlshash":"af92e1217443c4c9ee3d98f24e4fdf3481b8de1d097e21592ed24283ebe57449a3e945","first_seen":"2023-05-01T05:27:13Z","last_seen":"2026-09-08T10:01:49.574286Z","times_seen":213,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/litespeed/js/7dba6fb7ee5926c162986a95bb54289f.js?ver=97e1a","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.097Z","timestamp":1788162402097,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/litespeed/js/7dba6fb7ee5926c162986a95bb54289f.js?ver=97e1a HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 31 Aug 2026 07:46:41 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a953161-19eb\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6635,"size_decoded":2787,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (4043)","md5":"34b7a3157a5046401828fc341eb29c5c","sha1":"23603180b6ad2cf5dc2ce3861a89983044c77f0b","sha256":"c8c144eb75af7fa8a84918141c548a3cbd90d242bb092cd81abe71b2550b5394","sha512":"177fe6a87afa1b5ac5f3e92ec021c97306eddc81e68590a13782c2619c7a7e4e54fbe421283d1cc9ec5ea8832d8e467c5451aa0f3e932e1bc767fe1d85d4421f","ssdeep":"192:lmPfv8AViGaWFIkwvbOHzdIr469nyIKzgcxh2xDaM2DbnJ8:lM8miGdx9zd04698ny","tlshash":"96d1a7a563917cbe04f60e466c3eaf97bdbd84bd6d83e115600bfc885c784d343806aa","first_seen":"2026-08-07T08:55:41.891018Z","last_seen":"2026-08-31T07:47:12.880786Z","times_seen":4,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"au-rainbets.com/wp-content/uploads/2025/10/imgi_97_image.webp","fqdn":"au-rainbets.com","domain":"au-rainbets.com","tld":"com"},"ip":{"addr":"85.121.179.45","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://au-rainbets.com/","date":"2026-08-31T07:46:42.237Z","timestamp":1788162402237,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"au-rainbets.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 09:58:47 GMT","end":"Sat, 28 Nov 2026 09:58:46 GMT"},"fingerprint":{"sha1":"FB:83:AF:F2:E0:0C:7A:80:FB:8A:B0:FD:00:BB:32:B0:22:12:E6:40","sha256":"3E:0B:C7:48:C9:2A:CE:6D:23:51:05:BA:AF:7E:A8:00:7C:04:F8:2C:ED:77:AD:29:3A:67:0E:72:A1:98:04:3D"}}},"request":{"raw":"GET /wp-content/uploads/2025/10/imgi_97_image.webp HTTP/1.1\r\nHost: au-rainbets.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://au-rainbets.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:46:42 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3720\r\nlast-modified: Mon, 27 Oct 2025 16:13:00 GMT\r\netag: \"68ff9a0c-e88\"\r\nexpires: Wed, 30 Sep 2026 07:46:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3720,"size_decoded":4063,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b95a47e97bb88b206eee8304f541f61b","sha1":"ef29daa0ed039135e3f31ae732bba035aaf1840d","sha256":"fae57d8d5f0589cbcde5288e71221df468d0e6b73b394bcbac8d26eddcb8fd37","sha512":"77725116a55962b3a00b19e66c5f94c80613d18037c02e684d4a358ea59fdca6f76be2f7fe5b071378dad62fb98d2814c30560f6410fe4b0619af34e502c713e","ssdeep":"","tlshash":"15713f48c3235aecd3269b7469b01aaef5f53d885d3800265bcd63fe8683321503dcba","first_seen":"2026-07-08T11:54:42.227502Z","last_seen":"2026-08-31T07:47:12.881626Z","times_seen":8,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"au-rainbets.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}