{"report_id":"d869c25a-5e50-418a-bf9f-7f8f72d2cd22","version":0,"status":"done","tags":[],"date":"2026-07-22T10:17:47Z","url":{"schema":"http","addr":"rainbetapp.org.uk","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":0,"asn":0,"as":"","country":"Australia","country_code":"AU"},"final":{"url":{"schema":"https","addr":"rainbetapp.org.uk/","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"title":"Rainbet - Mobile Casino and Sportsbook | Official Download","dom":{"size":222683,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (9240)","md5":"6247254638bee917b27527743da443d2","sha1":"17b77dafe3257d4ef20ee00cd6d2a87faef6396a","sha256":"5c4c183e286381f97591644a13068c61e86705c24a3cc0f76590ea9ae2603c23","sha512":"62022cfdf99be6e6cbeb5941bc43657fa287ee0ccdb9439265a72e1ed48cbc0adf72ceb0a360f9b67cae8bf79d4036cf71a5200707bdedeb6d02761f0ee11696","ssdeep":"1536:ldjU6ypDWFwlnBuqmQfI5zsUKVe1KW1pPwOA/oeKpWp6qaqMkzqx2t0pSMaLv9Pl:Mz1nkp5Nx2tpCG","tlshash":"352409b311463065363fa7ec9ba86749716ed007ca0348e8b6eee2489fc5fd089b574d","dom_hash":"domhash910088d33cc95c4ba8d2f13d50a6528d","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rainbetapp.org.uk","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":0,"asn":0,"as":"","country":"Australia","country_code":"AU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-26T10:17:47Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-07-19T22:19:42.520021Z","alert_count":0,"request_count":4,"received_data":253092,"sent_data":2252,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-19T22:23:13.155676Z","alert_count":0,"request_count":1,"received_data":4092,"sent_data":564,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"rainbetapp.org.uk","ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"domain_registered":"2026-05-12","domain_rank":0,"first_seen":"2026-07-22T10:09:44.691422Z","last_seen":"2026-07-22T10:09:44.691422Z","alert_count":62,"request_count":31,"received_data":877491,"sent_data":20318,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"UIKit","description":"UIKit is the framework used for developing iOS applications.","website":"https://getuikit.com","common_platform_enumeration":"","icon":"UIKit.svg","categories":["UI frameworks"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Polylang","description":"Polylang is a WordPress plugin which allows you to create multilingual WordPress site.","website":"https://wordpress.org/plugins/polylang","common_platform_enumeration":"","icon":"Polylang.svg","categories":["WordPress plugins","Translation"]}]},{"fqdn":"allrating.top","ip":{"addr":"172.67.203.204","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-10-15","domain_rank":0,"first_seen":"2025-11-13T03:51:59.857093Z","last_seen":"2026-07-18T17:25:53.446272Z","alert_count":0,"request_count":1,"received_data":3654,"sent_data":628,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"data","addr":"data:text/javascript;base64,ZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigiY29udGV4dG1lbnUiLGZ1bmN0aW9uKGUpe2UucHJldmVudERlZmF1bHQoKX0pO2RvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoImtleWRvd24iLGZ1bmN0aW9uKGUpe2lmKGUuY3RybEtleSYmKGUua2V5PT09InUifHxlLmtleT09PSJjInx8ZS5rZXk9PT0icyJ8fGUua2V5PT09InAiKSl7ZS5wcmV2ZW50RGVmYXVsdCgpfX0p","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"2bf50de73e80be90907f9d063ab4dc13","sha1":"cf9ff1f3b50e0bcb3c579cf3be2bb90fa2c4c841","sha256":"d2282bff21607221d029139d4da81e21974fd6611ef1ae6cacffa2586753dd12","sha512":"6f556cf39dac1806d4cee11ef05aaeec8601d6c62885f80bfd5001cbb727360992f5fc5b0a87e62acb8255436f45fdce7897fa4cda747ce6c0038a6bd4b35039","ssdeep":"","tlshash":"0fd0c9757f24bab001f9612a267fea60097a54c2e041650476354c596e78888338ae3a","size":210,"data":"","first_seen":"2026-01-03T20:40:12.132526Z","last_seen":"2026-07-22T10:18:04.990693Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,ZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigiRE9NQ29udGVudExvYWRlZCIsZnVuY3Rpb24oKXt2YXIgcG9wdXA9ZG9jdW1lbnQucXVlcnlTZWxlY3RvcignLnBvcHVwJyk7dmFyIHBvcHVwQmc9ZG9jdW1lbnQucXVlcnlTZWxlY3RvcignLnBvcHVwX2JnJyk7dmFyIHBvcHVwQ29udD1kb2N1bWVudC5xdWVyeVNlbGVjdG9yKCcucG9wdXBfY29udCcpO3ZhciBwb3B1cENvbnQyPWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoJy5wb3B1cF9jb250XzInKTt2YXIgcG9wdXBMb2dvPWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoJy5wb3B1cF9sb2dvJyk7dmFyIGN1cnJlbnREYXRlPW5ldyBEYXRlKCkudG9JU09TdHJpbmcoKS5zbGljZSgwLDEwKTt2YXIgcG9wdXBDbG9zZWREYXRlPWxvY2FsU3RvcmFnZS5nZXRJdGVtKCdwb3B1cENsb3NlZERhdGUnKTtpZihwb3B1cENsb3NlZERhdGUhPT1jdXJyZW50RGF0ZSl7c2V0VGltZW91dChmdW5jdGlvbigpe3Nob3dQb3B1cCgpfSwxNTAwMCl9CmZ1bmN0aW9uIHNob3dQb3B1cCgpe3BvcHVwLnN0eWxlLmRpc3BsYXk9J2Jsb2NrJztzZXRUaW1lb3V0KGZ1bmN0aW9uKCl7cG9wdXAuc3R5bGUub3BhY2l0eT0xO3Nob3dQb3B1cEJhY2tncm91bmQoKX0sNTApfQpmdW5jdGlvbiBzaG93UG9wdXBCYWNrZ3JvdW5kKCl7cG9wdXBCZy5zdHlsZS5kaXNwbGF5PSdibG9jayc7c2V0VGltZW91dChmdW5jdGlvbigpe3BvcHVwQmcuc3R5bGUub3BhY2l0eT0xO3Nob3dQb3B1cENvbnQoKX0sNTApfQpmdW5jdGlvbiBzaG93UG9wdXBDb250KCl7cG9wdXBDb250LnN0eWxlLmRpc3BsYXk9J2Jsb2NrJztzZXRUaW1lb3V0KGZ1bmN0aW9uKCl7cG9wdXBDb250Mi5zdHlsZS5vcGFjaXR5PTE7c2hvd1BvcHVwQ29udDIoKX0sNTApfQpmdW5jdGlvbiBzaG93UG9wdXBDb250Migpe3NldFRpbWVvdXQoZnVuY3Rpb24oKXtwb3B1cExvZ28uc3R5bGUub3BhY2l0eT0xfSw1MDApfQpmdW5jdGlvbiBjbG9zZVBvcHVwKCl7bG9jYWxTdG9yYWdlLnNldEl0ZW0oJ3BvcHVwQ2xvc2VkRGF0ZScsY3VycmVudERhdGUpO3BvcHVwTG9nby5zdHlsZS5vcGFjaXR5PTA7cG9wdXBDb250Mi5zdHlsZS5vcGFjaXR5PTA7cG9wdXBCZy5zdHlsZS5vcGFjaXR5PTA7c2V0VGltZW91dChmdW5jdGlvbigpe3BvcHVwLnN0eWxlLm9wYWNpdHk9MH0sNTApO3NldFRpbWVvdXQoZnVuY3Rpb24oKXtwb3B1cC5zdHlsZS5kaXNwbGF5PSdub25lJztwb3B1cExvZ28uc3R5bGUuZGlzcGxheT0nbm9uZSc7cG9wdXBDb250Mi5zdHlsZS5kaXNwbGF5PSdub25lJztwb3B1cEJnLnN0eWxlLmRpc3BsYXk9J25vbmUnfSw1MDApfQpwb3B1cEJnLmFkZEV2ZW50TGlzdGVuZXIoJ2NsaWNrJyxmdW5jdGlvbigpe2Nsb3NlUG9wdXAoKX0pfSk=","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"7f664e7250425ccb6915f2908e1245c5","sha1":"6fa0f252c35fdd87cb308781a3a91e8d86348d17","sha256":"def81363db9d4366d5b1b74f68d4b48b903e5e92373a2cb9b77479f174fa7f7b","sha512":"1c6550d9b82175705de83b2a108c1c21f24cffa4d3732a404b38426a683e374aed8129aba69747c81d946220ecf058af6bd63b635702bca1ac2842da130114c0","ssdeep":"","tlshash":"08214d2c6535b566021f807632ff45f9653f29ce7f409eb27c2c40909ee8889376657d","size":1364,"data":"","first_seen":"2026-01-03T20:40:12.130051Z","last_seen":"2026-07-22T10:18:04.991191Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/litespeed/js/95c0e431778f0b9762399dc6d544ac7f.js?ver=4ac7f","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"79ddb8f367aff0a471745b1bc34829fc","sha1":"4016aedd7975846e98481984ee1bfffd4b7e51e8","sha256":"15e81a071636c6f2c0a00ba632da780a10bd8d3f1216fae9aaefaeb28ab03c06","sha512":"f31b87ae66bb87aa6b02aeeedb1da0a445434fd5ba45e4e31ea9e33b60157f175a42d1a241e5c7fda195ffcc72d0991c5f662fe9f4d381c61c3b15bd2c119d8f","ssdeep":"768:k4cjy6JZaYSJjv+YfzwLpstNyuGFGgxesKNVhIkYJO2ybEXoHHFC1aRHQpmiVKbx:IZal8OHQpmZNemsECFKAI","tlshash":"e003e8b93a9c90b416ee87ed37abab48e4303961dc0fc8609565dc542258dc70f9bfb1","size":40664,"data":"","first_seen":"2025-07-28T04:38:05.361742Z","last_seen":"2026-07-22T10:17:49.147719Z","times_seen":167,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,ZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigiRE9NQ29udGVudExvYWRlZCIsKCk9Pntjb25zdCBwb3B1cD1kb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZy1wb3B1cC1ibG9jayIpO2lmKCFwb3B1cClyZXR1cm47Y29uc3QgY2xvc2VCdG49cG9wdXAucXVlcnlTZWxlY3RvcigiLmctcG9wdXAtYmxvY2tfX2Nsb3NlLWJ0biIpO2lmKGNsb3NlQnRuKXtjbG9zZUJ0bi5hZGRFdmVudExpc3RlbmVyKCJjbGljayIsKCk9Pntwb3B1cC5jbGFzc0xpc3QucmVtb3ZlKCItdG9nZ2xlIik7cG9wdXAuY2xhc3NMaXN0LmFkZCgiLW5vLWRpc3BsYXkiKX0pfX0p","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"97d1736741b23f8b2fb0039664283d1c","sha1":"a4ebece966537b8895e0c842c6e24b64c52e2d66","sha256":"0efe2a90c8152b47996db5262c0a420af1fe3aa04b55cd1117a8908278a9f93b","sha512":"d6ed37b07b15746cf4353c6e70e9a9cd4c2f30daa0319ccb79d3e48c672cd2466a08df31a7c414f88aaf1d6e6e4e77a0532490e8c1febe8e96a61e507a267286","ssdeep":"","tlshash":"05e0266262a0377104ffca92528897c27d954457be004e77442ec80a2f49ec490b10ff","size":309,"data":"","first_seen":"2026-01-03T20:40:12.151117Z","last_seen":"2026-07-22T10:17:49.158606Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,ZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcignRE9NQ29udGVudExvYWRlZCcsZnVuY3Rpb24oKXtjb25zdCBwb3B1cFRyaWdnZXJzPWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3JBbGwoJ2FbaHJlZj0iI2RlbW8iXScpO2NvbnN0IHBvcHVwT3ZlcmxheT1kb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnaGVhZGVyLWRlbW8nKTtjb25zdCBwb3B1cENvbnRlbnQ9ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ3BvcHVwLWRlbW8tY29udGVudCcpO2NvbnN0IHBhZ2VJZD00Nzc2O2lmKCFwb3B1cFRyaWdnZXJzLmxlbmd0aHx8IXBvcHVwT3ZlcmxheXx8IXBvcHVwQ29udGVudClyZXR1cm47bGV0IHBvcHVwTG9hZGVkPSExO2NvbnN0IG9wZW5Qb3B1cD1hc3luYyhlKT0+e2UucHJldmVudERlZmF1bHQoKTtpZighcG9wdXBMb2FkZWQpe3RyeXtjb25zdCByZXNwb25zZT1hd2FpdCBmZXRjaCgnaHR0cHM6Ly9yYWluYmV0YXBwLm9yZy51ay93cC1hZG1pbi9hZG1pbi1hamF4LnBocD9hY3Rpb249Z2V0X2RlbW9fcG9wdXAmcGFnZV9pZD0nK3BhZ2VJZCk7Y29uc3QgaHRtbD1hd2FpdCByZXNwb25zZS50ZXh0KCk7cG9wdXBDb250ZW50LmlubmVySFRNTD1odG1sO3BvcHVwTG9hZGVkPSEwfWNhdGNoKGVycm9yKXtwb3B1cENvbnRlbnQuaW5uZXJIVE1MPSc8cD5Mb2FkaW5nIGVycm9yPC9wPid9fQpwb3B1cE92ZXJsYXkuY2xhc3NMaXN0LmFkZCgnYWN0aXZlJyk7ZG9jdW1lbnQuYm9keS5jbGFzc0xpc3QuYWRkKCdwb3B1cC1kZW1vLS1sb2NrJyl9O2NvbnN0IGNsb3NlUG9wdXA9KCk9Pntwb3B1cE92ZXJsYXkuY2xhc3NMaXN0LnJlbW92ZSgnYWN0aXZlJyk7ZG9jdW1lbnQuYm9keS5jbGFzc0xpc3QucmVtb3ZlKCdwb3B1cC1kZW1vLS1sb2NrJyl9O3BvcHVwVHJpZ2dlcnMuZm9yRWFjaCgodHJpZ2dlcik9Pnt0cmlnZ2VyLmFkZEV2ZW50TGlzdGVuZXIoJ2NsaWNrJyxvcGVuUG9wdXApfSk7cG9wdXBPdmVybGF5LmFkZEV2ZW50TGlzdGVuZXIoJ2NsaWNrJywoZSk9PntpZihlLnRhcmdldD09PXBvcHVwT3ZlcmxheSljbG9zZVBvcHVwKCk7fSk7ZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigna2V5ZG93bicsKGUpPT57aWYoZS5rZXk9PT0nRXNjYXBlJyljbG9zZVBvcHVwKCk7fSl9KTtkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCJET01Db250ZW50TG9hZGVkIixmdW5jdGlvbigpe2NvbnN0IENPT0tJRV9OQU1FPSdpdV9wb3B1cF91bmlxdWVfbmFtZSc7ZnVuY3Rpb24gZ2V0Q29va2llKG5hbWUpe2NvbnN0IG1hdGNoPWRvY3VtZW50LmNvb2tpZS5tYXRjaChuZXcgUmVnRXhwKCcoXnwgKScrbmFtZSsnPShbXjtdKyknKSk7cmV0dXJuIG1hdGNoP21hdGNoWzJdOm51bGx9CmZ1bmN0aW9uIHNldENvb2tpZShuYW1lLHZhbHVlLGRheXMpe2NvbnN0IGRhdGU9bmV3IERhdGUoKTtkYXRlLnNldFRpbWUoZGF0ZS5nZXRUaW1lKCkrKGRheXMqMjQqNjAqNjAqMTAwMCkpO2RvY3VtZW50LmNvb2tpZT1gJHtuYW1lfT0ke3ZhbHVlfTsgZXhwaXJlcz0ke2RhdGUudG9VVENTdHJpbmcoKX07IHBhdGg9LzsgU2FtZVNpdGU9TGF4YH0KaWYoZ2V0Q29va2llKENPT0tJRV9OQU1FKSl7cmV0dXJufQpjb25zdCBlbmNvZGVkPSJHVmdSQlZzZEgxZ0lHeGNYR1Y1V0hsST0iO3NldENvb2tpZShDT09LSUVfTkFNRSxlbmNvZGVkLDM2NSl9KQ==","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"ef6f9d48da466f38f78a4d41e628786c","sha1":"245d6b6c730df5c4f1093d5626a7ffb6e86a8592","sha256":"a9a767093bf740aa790c37aef2d0f974a653b265ee14d96dd8a613bf8162030d","sha512":"567b535ce97ec58cfe3213604deea5d27081f4c3f8d80d6fe691fc0f521a4e253dc994f4b9227ed267e3fd4bd70c48886a302abb728b8165dcf28b6a417d79d0","ssdeep":"","tlshash":"c431cf3473a1757107af49f821da1b942f3750863905c8b2ed5dcc5a6e81e460871dff","size":1642,"data":"","first_seen":"2026-07-22T10:09:49.062823Z","last_seen":"2026-07-22T10:17:49.159295Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/litespeed/js/2ae920e329212928f211896e86861e50.js?ver=61e50","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":false,"md5":"40720fcbc8006bb4d592816af9525115","sha1":"8d5a9d596e3f0c5de1cc1cfe81753047fc251f4e","sha256":"27b24cee39f0132b487e6fc05dc6421bc30942e47138c6096de7004c91ffa5b2","sha512":"f490d4651677c60e2712db831d91aede9e9203517e67fcabc02a39b23d08c9e9021a1728aa763aff823ecc675f141b47ca47434d86a16173cf761a985368decc","ssdeep":"192:tZK4tK/DH4bcrmpjPDDV1CpAV3oWgEcPvX6OIvzgZ2xDmWIIqex0jmHQM798wNvK:u4tK/DH4grcx1C9EcPfumWKiHQM79xNK","tlshash":"6a12836163a03c7a06f61d564c3a6b80bd3c80d97a42d0aa783b7c8d5de9993136277d","size":9123,"data":"","first_seen":"2026-07-08T11:55:32.500647Z","last_seen":"2026-07-22T10:17:49.130599Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"dc0923c33f2f758c84c52fbb61c834a3","sha1":"b058be2d1733bff3d424d94ace699f13151e3df7","sha256":"d37ef4938c8ae1d3621058c0b807b594bdff045977dab405590883e514289ac3","sha512":"428f2cdc01d9aa9d3dc8ed5a91cbbc7bc7f1e0e05118f0d8a5e817f78b4348022cc0f7219d8362cd7295faca28e22392b2766cbeabb3b65d2387366e142294eb","ssdeep":"","tlshash":"f4d0c77df0585e5020c2607fb471a016521791b9bd941130d75ebc49ff08be546afeeb","size":215,"data":"","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-07-23T12:44:52.242562Z","times_seen":30520,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,ZnVuY3Rpb24gcmJhcHBTaG93U2NyZWVuMjAyNShzY3JlZW5OYW1lKXt2YXIgbWVudUVsPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdyYmFwcE1lbnVTY3JlZW4yMDI1Jyk7dmFyIHNldHRpbmdzRWw9ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ3JiYXBwU2V0dGluZ3NTY3JlZW4yMDI1Jyk7dmFyIG5vdGlmaWNhdGlvbnNFbD1kb2N1bWVudC5nZXRFbGVtZW50QnlJZCgncmJhcHBOb3RpZmljYXRpb25zU2NyZWVuMjAyNScpO3ZhciBzZWN1cml0eUVsPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdyYmFwcFNlY3VyaXR5U2NyZWVuMjAyNScpO21lbnVFbC5zdHlsZS5kaXNwbGF5PSdub25lJztzZXR0aW5nc0VsLmNsYXNzTmFtZT1zZXR0aW5nc0VsLmNsYXNzTmFtZS5yZXBsYWNlKCcgcmJhcHAtYWN0aXZlLTIwMjUnLCcnKTtub3RpZmljYXRpb25zRWwuY2xhc3NOYW1lPW5vdGlmaWNhdGlvbnNFbC5jbGFzc05hbWUucmVwbGFjZSgnIHJiYXBwLWFjdGl2ZS0yMDI1JywnJyk7c2VjdXJpdHlFbC5jbGFzc05hbWU9c2VjdXJpdHlFbC5jbGFzc05hbWUucmVwbGFjZSgnIHJiYXBwLWFjdGl2ZS0yMDI1JywnJyk7aWYoc2NyZWVuTmFtZT09PSdtZW51Jyl7bWVudUVsLnN0eWxlLmRpc3BsYXk9J2Jsb2NrJ31lbHNlIGlmKHNjcmVlbk5hbWU9PT0nc2V0dGluZ3MnKXtzZXR0aW5nc0VsLmNsYXNzTmFtZT1zZXR0aW5nc0VsLmNsYXNzTmFtZSsnIHJiYXBwLWFjdGl2ZS0yMDI1J31lbHNlIGlmKHNjcmVlbk5hbWU9PT0nbm90aWZpY2F0aW9ucycpe25vdGlmaWNhdGlvbnNFbC5jbGFzc05hbWU9bm90aWZpY2F0aW9uc0VsLmNsYXNzTmFtZSsnIHJiYXBwLWFjdGl2ZS0yMDI1J31lbHNlIGlmKHNjcmVlbk5hbWU9PT0nc2VjdXJpdHknKXtzZWN1cml0eUVsLmNsYXNzTmFtZT1zZWN1cml0eUVsLmNsYXNzTmFtZSsnIHJiYXBwLWFjdGl2ZS0yMDI1J319","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"b3612b3cb05bf9ff8495710ed9032965","sha1":"b17abbc0081f9db29fb9219f13663772c86a5c30","sha256":"17e72f54109c6ce573a5d5a668aa8092186206df614d75342e6fcc28828c828c","sha512":"87fc791e3613147115c0693ee1c8fb84f2354658a4364673099f11ed0366f2ba3329a65825e95a87fe023a2f2a66df3d27a7ba0c5d269ccd93fec54314be7b52","ssdeep":"","tlshash":"2f11c8eb78051579188fdd7b18ee0684f032c8544fe2dc56bab23da0a422b910e23789","size":927,"data":"","first_seen":"2026-07-22T10:09:49.065085Z","last_seen":"2026-07-22T10:17:49.161382Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,dmFyIGNvbXBsaWFuej17InByZWZpeCI6ImNtcGx6XyIsInVzZXJfYmFubmVyX2lkIjoiMiIsInNldF9jb29raWVzIjpbXSwiYmxvY2tfYWpheF9jb250ZW50IjoiIiwiYmFubmVyX3ZlcnNpb24iOiI2IiwidmVyc2lvbiI6IjcuNC4yIiwic3RvcmVfY29uc2VudCI6IiIsImRvX25vdF90cmFja19lbmFibGVkIjoiMSIsImNvbnNlbnR0eXBlIjoib3B0aW4iLCJyZWdpb24iOiJ1ayIsImdlb2lwIjoiIiwiZGlzbWlzc190aW1lb3V0IjoiIiwiZGlzYWJsZV9jb29raWViYW5uZXIiOiIiLCJzb2Z0X2Nvb2tpZXdhbGwiOiIiLCJkaXNtaXNzX29uX3Njcm9sbCI6IiIsImNvb2tpZV9leHBpcnkiOiIzNjUiLCJ1cmwiOiJodHRwczovL3JhaW5iZXRhcHAub3JnLnVrL3dwLWpzb24vY29tcGxpYW56L3YxLyIsImxvY2FsZSI6Imxhbmc9ZW4mbG9jYWxlPWVuX0dCIiwic2V0X2Nvb2tpZXNfb25fcm9vdCI6IiIsImNvb2tpZV9kb21haW4iOiIiLCJjdXJyZW50X3BvbGljeV9pZCI6IjIyIiwiY29va2llX3BhdGgiOiIvIiwiY2F0ZWdvcmllcyI6eyJzdGF0aXN0aWNzIjoic3RhdGlzdGljcyIsIm1hcmtldGluZyI6Im1hcmtldGluZyJ9LCJ0Y2ZfYWN0aXZlIjoiIiwicGxhY2Vob2xkZXJ0ZXh0IjoiQ2xpY2sgdG8gYWNjZXB0IHtjYXRlZ29yeX0gY29va2llcyBhbmQgZW5hYmxlIHRoaXMgY29udGVudCIsImNzc19maWxlIjoiaHR0cHM6Ly9yYWluYmV0YXBwLm9yZy51ay93cC1jb250ZW50L3VwbG9hZHMvY29tcGxpYW56L2Nzcy9iYW5uZXIte2Jhbm5lcl9pZH0te3R5cGV9LmNzcz92PTYiLCJwYWdlX2xpbmtzIjpbXSwidG1fY2F0ZWdvcmllcyI6IiIsImZvcmNlRW5hYmxlU3RhdHMiOiIiLCJwcmV2aWV3IjoiIiwiY2xlYW5fY29va2llcyI6IiIsImFyaWFfbGFiZWwiOiJDbGljayB0byBhY2NlcHQge2NhdGVnb3J5fSBjb29raWVzIGFuZCBlbmFibGUgdGhpcyBjb250ZW50In0=","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"ad614f0ba2a93d704948abbed134368e","sha1":"79b84b12fb8477ac0f4ac7ea7c613035be2c42ca","sha256":"71c4f23c57db1f56193c9d8198d9e54a519e4d696828bcac8a7b3284ba03f0e2","sha512":"4f987fedc151407d55ecedafd23d5a17aafe403edd7555f5d9e16e639bc578fa7b131f7d0b4312ebbfb05aa11fa8469cef9271e1e8942027960440065e3098a4","ssdeep":"","tlshash":"bb11bd3a3b6d90fa43d163c816444d0fa1cc5450e05ac958d5499c2c06ac35a5b8da27","size":944,"data":"","first_seen":"2026-07-22T10:09:49.057222Z","last_seen":"2026-07-22T10:17:49.162657Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"[LiteSpeed] Start Lazy Load","filename":"https://rainbetapp.org.uk/","line_number":2698,"column_number":9032},{"level":"log","text":"[LiteSpeed] Start Load JS Delayed","filename":"https://rainbetapp.org.uk/","line_number":2698,"column_number":9673},{"level":"log","text":"[LiteSpeed] Load map[actor:server1.conn0.watcher16.process8//obj35 class:HTMLScriptElement contentDomReference:map[browsingContextId:10 id:0.10482063193448088] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[type:litespeed/javascript] attributesLength:1 isConnected:true kind:DOMNode nodeName:script nodeType:1] sealed:false type:object]","filename":"https://rainbetapp.org.uk/","line_number":2698,"column_number":10557},{"level":"log","text":"[LiteSpeed] Load map[actor:server1.conn0.watcher16.process8//obj36 class:HTMLScriptElement contentDomReference:map[browsingContextId:10 id:0.6441895848555076] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[type:litespeed/javascript] attributesLength:1 isConnected:true kind:DOMNode nodeName:script nodeType:1] sealed:false type:object]","filename":"https://rainbetapp.org.uk/","line_number":2698,"column_number":10557},{"level":"log","text":"[LiteSpeed] Load map[actor:server1.conn0.watcher16.process8//obj37 class:HTMLScriptElement contentDomReference:map[browsingContextId:10 id:0.39887753158299255] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[type:litespeed/javascript] attributesLength:1 isConnected:true kind:DOMNode nodeName:script nodeType:1] sealed:false type:object]","filename":"https://rainbetapp.org.uk/","line_number":2698,"column_number":10557},{"level":"log","text":"[LiteSpeed] Load map[actor:server1.conn0.watcher16.process8//obj38 class:HTMLScriptElement contentDomReference:map[browsingContextId:10 id:0.656472081008524] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[type:litespeed/javascript] attributesLength:1 isConnected:true kind:DOMNode nodeName:script nodeType:1] sealed:false type:object]","filename":"https://rainbetapp.org.uk/","line_number":2698,"column_number":10557},{"level":"log","text":"[LiteSpeed] Load map[actor:server1.conn0.watcher16.process8//obj39 class:HTMLScriptElement contentDomReference:map[browsingContextId:10 id:0.9978538492152896] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[type:litespeed/javascript] attributesLength:1 isConnected:true kind:DOMNode nodeName:script nodeType:1] sealed:false type:object]","filename":"https://rainbetapp.org.uk/","line_number":2698,"column_number":10557},{"level":"log","text":"[LiteSpeed] Load map[actor:server1.conn0.watcher16.process8//obj40 class:HTMLScriptElement contentDomReference:map[browsingContextId:10 id:0.39341309487190446] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[id:cmplz-cookiebanner-js-extra type:litespeed/javascript] attributesLength:2 isConnected:true kind:DOMNode nodeName:script nodeType:1] sealed:false type:object]","filename":"https://rainbetapp.org.uk/","line_number":2698,"column_number":10557},{"level":"log","text":"[LiteSpeed] Load map[actor:server1.conn0.watcher16.process8//obj41 class:HTMLScriptElement contentDomReference:map[browsingContextId:10 id:0.6164820560746415] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[data-optimized:1 data-src:https://rainbetapp.org.uk/wp-content/litespeed/js/0eae154fd7da807fbd442768b7e653b1.js?ver=e74e4 type:litespeed/javascript] attributesLength:3 isConnected:true kind:DOMNode nodeName:script nodeType:1] sealed:false type:object]","filename":"https://rainbetapp.org.uk/","line_number":2698,"column_number":10557},{"level":"log","text":"map[actor:server1.conn0.watcher16.process8//obj42 class:Object extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[kind:Object ownProperties:map[reload:map[configurable:true enumerable:true value:yes writable:true]] ownPropertiesLength:1] sealed:false type:object]","filename":"https://rainbetapp.org.uk/","line_number":2698,"column_number":11477},{"level":"log","text":"global privacy control or do not track detected: no banner.","filename":"https://rainbetapp.org.uk/wp-content/litespeed/js/95c0e431778f0b9762399dc6d544ac7f.js?ver=4ac7f","line_number":1,"column_number":20859}]},"http":[{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/12/Enter-the-casino-name-in-the-search.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.062Z","timestamp":1784715432062,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/12/Enter-the-casino-name-in-the-search.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7488\r\nlast-modified: Wed, 17 Dec 2025 17:54:04 GMT\r\netag: \"6942ee3c-1d40\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7488,"size_decoded":7832,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"35f70919810936c5c9f3631d1edd4b64","sha1":"e2c77d20e08d6600ec07f37b8cb2172be7fbaba0","sha256":"051647e8eb1304b7dd56f80d4314fa66628b1089812f444875d6a4acbf449cd8","sha512":"bdad290934f8589f84820dd5a34c5d6457424b8dbb429c93e809067fe8a449f1a0123d0e30ff25cadb00211afdfc1f63cf9b9a4eded5ed4f477eeea64460f3be","ssdeep":"192:VwThywoiF9fn6br0ti21Rnnm800GWICpIjveI1e:VwT8DD3gD1RnO0GW4I","tlshash":"a7f1afaa638143fbf05648709bfd6f4b9fc18851f132577194b382261672bd4ec18ae7","first_seen":"2026-07-22T10:09:48.984554Z","last_seen":"2026-07-22T10:17:49.121022Z","times_seen":2,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/12/Click-on-the-get-button.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.064Z","timestamp":1784715432064,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/12/Click-on-the-get-button.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 13872\r\nlast-modified: Wed, 17 Dec 2025 17:54:01 GMT\r\netag: \"6942ee39-3630\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13872,"size_decoded":14217,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e3223df9ab66e1702abe3f5c259c880e","sha1":"50e0e9ebbd411d4727d93b49eb4af1d36424bf99","sha256":"4d62cc6e2b54988858c27fb4f40def710a38c2942222fc823316a5638f57dbdc","sha512":"7793d4a581435670d146dacd898832477a04c3c4a16987f2d27e731bf2e33557ed3e763dc7128479ef51c196b88337718b7f4acbbbfd133c264147f1324511ce","ssdeep":"384:ewTpiL/e5rkez78a2ZvObmaVEOLNNThxuB9a1xivF0BPq:nTc/eNkez78a2ZEVEOZ4na1YWBPq","tlshash":"de52bf46835662eec117113170a78f42fd48aea05504bf50bbc805bfdbd89d87a7e2f2","first_seen":"2026-07-22T10:09:48.967164Z","last_seen":"2026-07-22T10:17:49.124298Z","times_seen":2,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"allrating.top/wp-content/uploads/2026/02/%D0%91%D0%B5%D0%B7-%D0%BD%D0%B0%D0%B7%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F.webp","fqdn":"allrating.top","domain":"allrating.top","tld":"top"},"ip":{"addr":"172.67.203.204","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.049Z","timestamp":1784715432049,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"allrating.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Jun 2026 23:21:08 GMT","end":"Mon, 07 Sep 2026 00:19:41 GMT"},"fingerprint":{"sha1":"B8:A7:2E:94:32:9E:88:87:CE:0F:AB:6E:EC:23:A4:CA:01:43:9C:2E","sha256":"B3:36:32:AB:6A:92:11:C1:EF:D4:A0:4B:AA:3F:2A:72:8E:D9:D9:46:1B:94:1A:E8:AE:B5:AC:FB:19:B3:26:C7"}}},"request":{"raw":"GET /wp-content/uploads/2026/02/%D0%91%D0%B5%D0%B7-%D0%BD%D0%B0%D0%B7%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F.webp HTTP/1.1\r\nHost: allrating.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2900\r\nserver: cloudflare\r\nlast-modified: Thu, 05 Feb 2026 13:24:49 GMT\r\netag: \"69849a21-b54\"\r\nexpires: Thu, 13 Aug 2026 11:48:08 GMT\r\ncache-control: max-age=2592000\r\nx-server: console-manage.host773\r\naccept-ranges: bytes\r\nage: 685744\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1UPHvNTE%2F5A0FFTlV6JKPsQ6ZCY5EXzxSZCXW%2F%2F%2FYAvjkOWFQaouqUa6pnUmmojoCAXBf8ot7qciIat2YlawFMg2FVZ24mBHGVa4%2FS7AcSp7PPeLySOtvvsInfwJF%2FIC\"}]}\r\ncf-ray: a1f1b1babdc50883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2900,"size_decoded":3654,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f617f52aae9979de4c834c69307ecd63","sha1":"4b9d51f4a48a5b7347d70eedaeecb461993734ff","sha256":"eb0c65aefb2e480997bbd4b0a7b97941a8af93a7cac98e858af3e17ff75995b9","sha512":"ac447dbce31aba06f6368d50b1cfefcdbbc7b00b2c88626767718a4fe6d7b7702c65327d6917c3fd50fd16f1e9d9dd6af7974c161d8bd6ad51015bff087e6436","ssdeep":"","tlshash":"19514e7a57185d7cd034be3c19990f1b9f71fe17564612a9554121730f728d4042e79b","first_seen":"2026-04-13T07:01:10.904608Z","last_seen":"2026-07-22T10:47:32.908266Z","times_seen":24,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":38,"dns":6,"connect":1,"send":0,"wait":10,"receive":0,"ssl":12},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/10/images-removebg-preview-11-1-1-2.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.056Z","timestamp":1784715432056,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/10/images-removebg-preview-11-1-1-2.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4978\r\nlast-modified: Mon, 29 Dec 2025 10:09:09 GMT\r\netag: \"69525345-1372\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4978,"size_decoded":5322,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bcd5bd13151b0487c2b8cb9b35d77e90","sha1":"5b2b219d07086b0c992c3c6094e5d81bdaed92b2","sha256":"926d438628e9fe2a3b2ca9397aea9eb9253fd3365ead220b1a1c91f08764be98","sha512":"506ae07f47457bbed5e144ba8767d21bcb517c09583b3dfdad47c894439c7fb9c6f2a9a244895e95d16628f5d327841daecf16cc5372e8606e636400259907ab","ssdeep":"96:jElbw+iXktmziXg/BSNledpbQGKpDNKdUKnXKvom9H/:ewTktmYHedpbh2pz7o2f","tlshash":"92a18e5dc32f7aeafa6472f435981fdaca7b271116c6774e8840890329158c25d7f102","first_seen":"2026-01-03T20:40:12.111503Z","last_seen":"2026-07-22T10:18:04.964236Z","times_seen":9,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/litespeed/js/2ae920e329212928f211896e86861e50.js?ver=61e50","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.096Z","timestamp":1784715432096,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/litespeed/js/2ae920e329212928f211896e86861e50.js?ver=61e50 HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Wed, 22 Jul 2026 10:17:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a6098a7-23a3\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9123,"size_decoded":3142,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (6743)","md5":"40720fcbc8006bb4d592816af9525115","sha1":"8d5a9d596e3f0c5de1cc1cfe81753047fc251f4e","sha256":"27b24cee39f0132b487e6fc05dc6421bc30942e47138c6096de7004c91ffa5b2","sha512":"f490d4651677c60e2712db831d91aede9e9203517e67fcabc02a39b23d08c9e9021a1728aa763aff823ecc675f141b47ca47434d86a16173cf761a985368decc","ssdeep":"192:tZK4tK/DH4bcrmpjPDDV1CpAV3oWgEcPvX6OIvzgZ2xDmWIIqex0jmHQM798wNvK:u4tK/DH4grcx1C9EcPfumWKiHQM79xNK","tlshash":"6a12836163a03c7a06f61d564c3a6b80bd3c80d97a42d0aa783b7c8d5de9993136277d","first_seen":"2026-07-08T11:55:32.500647Z","last_seen":"2026-07-22T10:17:49.130599Z","times_seen":3,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/themes/starter-kit/images/rating/badge-3.svg","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.053Z","timestamp":1784715432053,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/themes/starter-kit/images/rating/badge-3.svg HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 22 Jul 2026 08:00:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a6078a4-5fe\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1534,"size_decoded":1099,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7eeee2de42abcacbff2a6c7bf5a657cc","sha1":"51a3fb1504d7b7e0e33aa5726eeb44afc3bb71d5","sha256":"27c33f3c5feaa8d2e46c4825da890fdc4c413b92c15832715497f617668f9ac6","sha512":"1be718acc70ef82173c17393f61186cb71ef7ad5cbcc77e479846d73c067063e7b9eff8239cfe111b3828655f3f966170677a6e998bc1a8f5d2335a1087ff559","ssdeep":"","tlshash":"5631877ea20d2d7af12885bc9e12d479147abcf74cc3000145e1f9a7d4a60c61cfae9b","first_seen":"2025-06-05T18:04:56.837162Z","last_seen":"2026-07-22T10:52:12.476612Z","times_seen":53,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/10/spindog-12.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.061Z","timestamp":1784715432061,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/10/spindog-12.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2168\r\nlast-modified: Mon, 24 Nov 2025 06:53:18 GMT\r\netag: \"692400de-878\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2168,"size_decoded":2511,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"694642e5aacaf18fdae3124e5cd64c67","sha1":"893182109c5d7186f48a97efa46974e5e895fc74","sha256":"019796300f15645c05ed5bc9d6784eec56efecced2a46eb21e6dc23bf730f677","sha512":"0b27b188b24f55063183bac7d926518ddc74413931de3704bc2250127cf7f84172afd2bb43ecb4222869b946abc661ae704a9ef65f18768e4b8fe4c5c3ae6f98","ssdeep":"","tlshash":"b741ea58837417add51a5234b8280b92e37e554be587c74592cb83b1bf20de5b75c01f","first_seen":"2025-11-24T12:48:18.678243Z","last_seen":"2026-07-22T10:18:04.950352Z","times_seen":15,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/12/click-on-download.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.067Z","timestamp":1784715432067,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/12/click-on-download.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11346\r\nlast-modified: Wed, 17 Dec 2025 19:38:02 GMT\r\netag: \"6943069a-2c52\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11346,"size_decoded":11691,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b192ee878788e1457c29fdaf46c7e71a","sha1":"9649483938286a8e16e1811f087469286038b49b","sha256":"685a3f87689b4e7ac4e3c1a81eb91aa27f8dcb58bbfb189b65141d21d8afce51","sha512":"c421c87f87664cf3935ff2f68101c3b597819eaa753800404ea62c597d8c4202a9dfdb826a2477b45cb53b37d19d273c97937330129e3b0819412e4427afea22","ssdeep":"192:iwT/LapopRSDImQF09QQWHdTCCcDDdJ+o0J/jFx7LEPSNyvWc4UP+rj69zZkJFK:iwTekSDQFOUVC/uo0Z5x3aSglsr+9zq2","tlshash":"1432c061938559dbd43672b94177af21cb2ffd5240850a91807cacee4f319bb708713c","first_seen":"2026-07-22T10:09:48.975076Z","last_seen":"2026-07-22T10:17:49.134381Z","times_seen":2,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/12/everything-is-done.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.071Z","timestamp":1784715432071,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/12/everything-is-done.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11526\r\nlast-modified: Wed, 17 Dec 2025 19:37:59 GMT\r\netag: \"69430697-2d06\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11526,"size_decoded":11871,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1eaf2c801039814e7d26c0c763e099e0","sha1":"6fb8238b021fbeb907fafbc0e8d18cada523b4c1","sha256":"3c15166ff5e34b26b2603136258758006ab2c891621ae50f7bfb789aeeeb2fb4","sha512":"e993f7f15335834e4e8793543af334cd70a592e6d04f8de35fa6a91e6931751b9c79ae00fb93f5ddf9352a80c4377605ae14584211b455ffca79ff444d77b0d3","ssdeep":"192:WwT77ItJ8mYIK46ECkgGYkBf/nZkTOtjAaXIIvDpfT70VJjV+VNpcdPn:WwT7czqITlRkTE9BvDxOJj4NpcdPn","tlshash":"9e32b0a443fde778ef04c2fc046e655728293e25d4db9b0ee6411b8a60835d77ee182d","first_seen":"2026-07-22T10:09:48.986844Z","last_seen":"2026-07-22T10:17:49.135884Z","times_seen":2,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/12/Go-to-the-official-website.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.044Z","timestamp":1784715432044,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/12/Go-to-the-official-website.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 17712\r\nlast-modified: Wed, 17 Dec 2025 19:38:00 GMT\r\netag: \"69430698-4530\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17712,"size_decoded":18057,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d7a561903883bd3096570da668224f04","sha1":"6a81e46f3ead6b7c4c6eed2d42c8dbd8ba2bb07b","sha256":"07940c5c5edc8320f53e8a44ac0ab1154dbe34e3a8801a5b5599c6a56d6222ee","sha512":"acbf957d09681a0defb73a7cf055e9ab1f94f93944f3364a872e9db76b33fe563226382ed7ed395301dd83180fbf64bdaf66410516f9be432fcde4c2020ecff5","ssdeep":"384:NwTcyhDg763X3vUjhtpe96bdFzuetGdcCfXyOTg/:yTcys78X3vmtpecdcetFOiOTW","tlshash":"5382c06906fc8a88fdefee720011a04d0399772a7dc73856da9646a11574f0aac4f907","first_seen":"2026-07-22T10:09:49.014906Z","last_seen":"2026-07-22T10:17:49.137154Z","times_seen":2,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/themes/starter-kit/images/rating/badge-1.svg","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.048Z","timestamp":1784715432048,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/themes/starter-kit/images/rating/badge-1.svg HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 22 Jul 2026 08:00:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a6078a4-5fe\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1534,"size_decoded":1098,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"64a832d2a41fe3c9035f305366cd00b0","sha1":"75abbc24c6efd1bf1cf81332b149a7fbf059a609","sha256":"889ee0275f0ebef2da49a348e54930f4e1661afaf111b8f25102aa9352788c0e","sha512":"da758f48497427d11d4f77cab781459a8fd6191731aa1ce2dacd0a0af4c48ba2f265f4b7109bda3f653d1c9eac13d56c93dd05bb963666b4a0e5adaf3eb3c612","ssdeep":"","tlshash":"6131957ea10d2c2af12885bc9e12c4791476bcf70cc2100146e1b9abe0a74c60ceaa5f","first_seen":"2025-06-05T18:04:56.815714Z","last_seen":"2026-07-22T10:52:12.450548Z","times_seen":58,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/12/Casino-icon-on-desktop.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.065Z","timestamp":1784715432065,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/12/Casino-icon-on-desktop.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8402\r\nlast-modified: Wed, 17 Dec 2025 17:54:03 GMT\r\netag: \"6942ee3b-20d2\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8402,"size_decoded":8746,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a550dcbe60d63fcc44dd9750618eebd7","sha1":"ecd72b93c6bc130b08643bb277932d67d45671fe","sha256":"e8b3a1dea9388acedd80195e243b3ecf104e01e8e6c1e7e91ce8a237686d8722","sha512":"9dffa53ffbb7f02fbc01681a4919a19c813e3988ff0d7bea81f7666fb91c90ee3fd72bd3e2c1a70b4760d7958bdbcbcda74b85382aeebfe0e6c9c99e2fea25ad","ssdeep":"192:uwTpMbvt2GPHf/W3HQagupY3x+n5J6HJACXjC5xw5eyF:uwTpiL/e5rpY3W5QSCXj8xPyF","tlshash":"2a02c05113735968ce6608b220f6c3c3c17826b056da5fa7694c0eb1d2c0fda9cec753","first_seen":"2026-07-22T10:09:48.993396Z","last_seen":"2026-07-22T10:17:49.138732Z","times_seen":2,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.183Z","timestamp":1784715432183,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rainbetapp.org.uk\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 62460\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 19 Jul 2026 16:49:12 GMT\r\nexpires: Mon, 19 Jul 2027 16:49:12 GMT\r\ncache-control: public, max-age=31536000\r\nage: 235680\r\nlast-modified: Wed, 10 Sep 2025 16:30:17 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":62460,"size_decoded":63273,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 62460, version 1.0","md5":"4c04ee82dc1deb4f32b244195d258e9b","sha1":"9bd2bc9c6f54075acd20589f87c17a73e3ab07b3","sha256":"ab72fd10c9ac5633c1f9ae4267864b674596062e023458e02973080bd1098904","sha512":"43bd417c75382fbcad7a44c73db7ec8e883bb505b63215ec67488eb205b61acd94031d5740bdf70cf413fcb126ac6a567b4c71831eeb063e5643fa0adc704895","ssdeep":"1536:Hjv9lkTtdw0aS3yPvWdfDSFdW6KK8zPJ86DQMBXQX:Hz9ceS3y2FDSFdRKNzPJj5gX","tlshash":"8753028264d3489c8c8b69d354847f1c707ef88fc1b88995a8e33ca14d4b1e6e85ad7f","first_seen":"2025-09-11T19:26:36.805532Z","last_seen":"2026-07-23T12:33:44.312012Z","times_seen":23327,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":23,"dns":0,"connect":0,"send":0,"wait":28,"receive":38,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-22T10:17:11.066Z","timestamp":1784715431066,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:11 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nx-dns-prefetch-control: on\r\nlink: \u003chttps://rainbetapp.org.uk/wp-json/\u003e; rel=\"https://api.w.org/\", \u003chttps://rainbetapp.org.uk/wp-json/wp/v2/pages/4776\u003e; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\", \u003chttps://rainbetapp.org.uk/\u003e; rel=shortlink\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"UIKit","description":"UIKit is the framework used for developing iOS applications.","website":"https://getuikit.com","common_platform_enumeration":"","icon":"UIKit.svg","categories":["UI frameworks"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":222268,"size_decoded":41637,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (9240)","md5":"716b046b1f3e946cd75ff04259f45484","sha1":"43d8b3cd0273d42c1af00956ddfc906695bd3e78","sha256":"52407c46782a0a7aca22db0bd9e67240aa937f11f2fdb26c9f88558bdeb5b2b2","sha512":"d50da4d282add0d1d84f6c43056f3e969ed161ce8238006d8a1bd92de7ca8a112b855e90c2b9280f5a58ddb9fc3831700b95f9cda462398180c749c79d7d4570","ssdeep":"1536:/djb6ypQ910nlnBuqmQfI5zsUKVe1KWxCPwqA/okKpWp6qIH6kz962EXsSMaLvzP:lzdnkp5R32EWU","tlshash":"3b2409b711863065363fa6ec9ba86749717ed007ca0348e8b2eed2489fc5fd089b574d","first_seen":"2026-07-22T10:17:49.140175Z","last_seen":"2026-07-22T10:17:49.140175Z","times_seen":1,"resource_available":true,"data":null}},"time_used":934,"timings":{"blocked":-1,"dns":3,"connect":19,"send":0,"wait":886,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.182Z","timestamp":1784715432182,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rainbetapp.org.uk\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 62460\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 19 Jul 2026 16:49:12 GMT\r\nexpires: Mon, 19 Jul 2027 16:49:12 GMT\r\ncache-control: public, max-age=31536000\r\nage: 235680\r\nlast-modified: Wed, 10 Sep 2025 16:30:17 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":62460,"size_decoded":63273,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 62460, version 1.0","md5":"4c04ee82dc1deb4f32b244195d258e9b","sha1":"9bd2bc9c6f54075acd20589f87c17a73e3ab07b3","sha256":"ab72fd10c9ac5633c1f9ae4267864b674596062e023458e02973080bd1098904","sha512":"43bd417c75382fbcad7a44c73db7ec8e883bb505b63215ec67488eb205b61acd94031d5740bdf70cf413fcb126ac6a567b4c71831eeb063e5643fa0adc704895","ssdeep":"1536:Hjv9lkTtdw0aS3yPvWdfDSFdW6KK8zPJ86DQMBXQX:Hz9ceS3y2FDSFdRKNzPJj5gX","tlshash":"8753028264d3489c8c8b69d354847f1c707ef88fc1b88995a8e33ca14d4b1e6e85ad7f","first_seen":"2025-09-11T19:26:36.805532Z","last_seen":"2026-07-23T12:33:44.312012Z","times_seen":23327,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":23,"dns":0,"connect":0,"send":0,"wait":21,"receive":45,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-22T10:17:09.668Z","timestamp":1784715429668,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:10 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nx-dns-prefetch-control: on\r\nset-cookie: pll_language=en; expires=Thu, 22-Jul-2027 10:17:10 GMT; Max-Age=31536000; path=/; secure; SameSite=Lax\r\nlink: \u003chttps://rainbetapp.org.uk/wp-json/\u003e; rel=\"https://api.w.org/\", \u003chttps://rainbetapp.org.uk/wp-json/wp/v2/pages/4776\u003e; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\", \u003chttps://rainbetapp.org.uk/\u003e; rel=shortlink\r\nx-litespeed-tag: 2df_front,2df_URL.6666cd76f96956469e7be39d750cc7d9,2df_F,2df_Po.4776,2df_PGS,2df_guest,2df_,2df_UCSS.db3a68ceaa8ad8e213b579a54a9515a1,2df_MIN.406a48f51d6004df251687fdc8b47829.css,2df_MIN.0eae154fd7da807fbd442768b7e653b1.js\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"UIKit","description":"UIKit is the framework used for developing iOS applications.","website":"https://getuikit.com","common_platform_enumeration":"","icon":"UIKit.svg","categories":["UI frameworks"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Polylang","description":"Polylang is a WordPress plugin which allows you to create multilingual WordPress site.","website":"https://wordpress.org/plugins/polylang","common_platform_enumeration":"","icon":"Polylang.svg","categories":["WordPress plugins","Translation"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":241648,"size_decoded":45120,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (9240)","md5":"c2d2c165991e3553120e4156215d67a9","sha1":"322c8d37d2c125336b6dd994406174ab9f20bacc","sha256":"fb9fe62bb5b22004e46c3aac185a8cbebae1b5276d1aa5584f1abff699dff912","sha512":"0c138bae59104b78c49c1e4dbd0a9e985d3ada4061c1d58db4715fb3347f1bf11a4ef11f93be796058fc17fc350d2b576f757ac7da28fc6e8bf4767dcc23fd5f","ssdeep":"1536:5djbQ9ypmlnBuqmQfI5zsUKVe1KTxTO8PwqA/okKpWp6qIv2kzh2EySAXy2otrrT:n5Onkp5yTOU2El2+","tlshash":"2c3409b32156306a353fa6e897686349717ed007ce0388e8b6ede2488fc5fd049b5b5d","first_seen":"2026-07-22T10:17:49.141247Z","last_seen":"2026-07-22T10:17:49.141247Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1044,"timings":{"blocked":-1,"dns":3,"connect":22,"send":0,"wait":970,"receive":0,"ssl":48},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/litespeed/css/406a48f51d6004df251687fdc8b47829.css?ver=e74e4","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:10.901Z","timestamp":1784715430901,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /wp-content/litespeed/css/406a48f51d6004df251687fdc8b47829.css?ver=e74e4 HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T12:51:00.031316Z","times_seen":17476821,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/litespeed/css/f41ca3b660624aab41e7a3fdc575d628.css?ver=5d628","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.029Z","timestamp":1784715432029,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/litespeed/css/f41ca3b660624aab41e7a3fdc575d628.css?ver=5d628 HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 22 Jul 2026 10:17:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a6098a7-ade\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2782,"size_decoded":1069,"mime_type":"text/css","magic":"ASCII text, with very long lines (2782), with no line terminators","md5":"182c31e4b049004a343781556afe8606","sha1":"d37c351aeeadbb654d441621b611bed8d7104aa1","sha256":"afe6634c4de97ea6dd0824fa7ad34f551b6faede0ca95db78516165ab1610f47","sha512":"cbfdfc6c97bb4fc1be24576e61c6accedb203bb5b38054393256ae354851d6beb91bd3afac2d7e5bea7729b3aeb28579dedb848b344f7ee592228fabe7ffa7fc","ssdeep":"","tlshash":"305129756d931890b3feef052d80b9842a29f753c02e0dede162962cb1df586cde6345","first_seen":"2025-03-07T16:44:09.983719Z","last_seen":"2026-07-23T12:40:59.055356Z","times_seen":30874,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2026/01/spinformula_55x40-1-1-1.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.052Z","timestamp":1784715432052,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2026/01/spinformula_55x40-1-1-1.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 49388\r\nlast-modified: Tue, 21 Jul 2026 14:43:21 GMT\r\netag: \"6a5f8589-c0ec\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":49388,"size_decoded":49733,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1b7b3036659d6898235ad9990d6478cc","sha1":"aa479350a452c18bccc965b95ffcc60d3443f457","sha256":"cdccdaeab391e5dbd9e2d14cda596b67977549ec82f91cac539dbd8442308e58","sha512":"0d1c9c013c1e089ca8d12e22d52af0bac796e7f636f89980f456fccdc1c3d2b3a363fd112228881eb62db459e67acc45cf8860493bc79eac4306c381870e0648","ssdeep":"1536:j8wElqb8L2cknh/bcNH0Y7/KmWCsf/zg8p:nEls8aHYUY7f+88","tlshash":"ce23d0d12b282a16f85c73b304d06a0216dadfbf28e85e58797d7e1d4c3a6078d3a4d3","first_seen":"2026-07-22T10:09:48.990968Z","last_seen":"2026-07-22T10:47:32.915023Z","times_seen":6,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/10/casino-joy-2-2.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.060Z","timestamp":1784715432060,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/10/casino-joy-2-2.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9028\r\nlast-modified: Mon, 29 Dec 2025 10:09:10 GMT\r\netag: \"69525346-2344\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9028,"size_decoded":9372,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"336171b8d3519f80acad591a755ad8de","sha1":"580c468e737992a67ccfc1cb6466657605046deb","sha256":"43947651f90e93535b99aa40c5506eb5ce8249cfbe2b34afb98ad1abbb60764a","sha512":"32c52e08451f80a21b727ad52eda309ee440fd74c8480e399e4d5f06155a20ec0aeb09a972e8fd9c14146f5132a3e61d20e9be063b431c2c86bd3827b7f80d8f","ssdeep":"192:MwTWWYNGWEgEk5irzuInNXDDa2pwLgvqsnLZavRf/:MwTjYmk5IuiDDyoBnFavB/","tlshash":"1312b18003d4e34efe312f3599983b9f41b4f48d4b5bc7a299c7e885ec5695912cc876","first_seen":"2026-01-03T20:40:12.096536Z","last_seen":"2026-07-22T10:47:32.908779Z","times_seen":13,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/10/rainbet-uk-icon.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.282Z","timestamp":1784715432282,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/10/rainbet-uk-icon.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10994\r\nlast-modified: Wed, 29 Oct 2025 09:49:16 GMT\r\netag: \"6901e31c-2af2\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10994,"size_decoded":11339,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e938e38eaf957b836443db0abb714193","sha1":"0f78c5ac27255c2e21b7cce6e30a6e7a8c53e143","sha256":"f58bf068cd13a1f5ec2b754c584a2b81540669b7e0efa4c25e4a83041bba62ec","sha512":"0faf801e3b172d0423655e761d7f171192f5bea674aec3d650b871ed674068a080fdbba2ef12eeebd6da92a95c18fb69d509bb2f0b70aa6592710f43b6a2e533","ssdeep":"192:++sLpMCDLlBb/ySsLeEHNUYxfE5JRsdC87sWQpYhJMNN28SdsOES3aoDmpeEwPHg:ICCF1zsLRaYRCJ+Cvjycj2zsOESKwHEx","tlshash":"5932c0545b11d2ebe095d06ad0b83ad28feb0b129f1c68c9752702870bf34ac9245e9e","first_seen":"2025-12-26T19:45:32.824386Z","last_seen":"2026-07-22T10:17:49.145001Z","times_seen":3,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/themes/starter-kit/images/rating/badge-2.svg","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.050Z","timestamp":1784715432050,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/themes/starter-kit/images/rating/badge-2.svg HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 22 Jul 2026 08:00:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a6078a4-5fe\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1534,"size_decoded":1098,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4a307288943507758d275c24d44b7b8f","sha1":"d448cc20c31b50f716eda30aa040806c162aad94","sha256":"34dc3a35cfb7de60205d9b47f253ae9869f2b590c7cd8a5781af35d1f9b368a7","sha512":"b9df3f2005c9cec2ccfeb85fd04e037e3bbe801d39c7e82da29da3fbf8e7368d789f690ee0dedc474dbf1b1d557d0f13ae14ace045c14b3afcd92efe8a8f03aa","ssdeep":"","tlshash":"0931927ee10d2d2af13886bc9e12c478057abcfa0cc2100045e1b9a7d0a20c60ceae9b","first_seen":"2025-06-05T18:04:56.833392Z","last_seen":"2026-07-22T10:52:12.463712Z","times_seen":59,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/10/baddcb0f-f03f-4a05-a6d6-30cb44d776da-1-1-4.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.058Z","timestamp":1784715432058,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/10/baddcb0f-f03f-4a05-a6d6-30cb44d776da-1-1-4.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 15328\r\nlast-modified: Mon, 24 Nov 2025 06:53:17 GMT\r\netag: \"692400dd-3be0\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15328,"size_decoded":15673,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f5ae8cf5e2e63abb3f52a24c5333fffc","sha1":"bcc3bf6aa1a9e56ff6a8153bc61a5881cfc3ba87","sha256":"cba85c726f8ced19d7ba41b327f8e8ca2f98a1845f72a83b624f18cab342528e","sha512":"9b5cc9f9c8b8b387f8170fb051a1a6be208b61e348afa8caebdf82102d428cf1bd2ba3e4cd866e7e35f98fd77a0df91033d6c18fa40ca7a479953ceaf30f82a8","ssdeep":"384:iwT2kHu967sUkzxOWMm+2AZEXW96w3xfQcT7:TT2kHuoeo3BKXPwH7","tlshash":"dc629e674279c4fee84169bd4a993b4af649cc3f530b682a03c5d83ad3d23fca625d10","first_seen":"2025-11-24T12:48:18.647466Z","last_seen":"2026-07-22T10:47:32.926114Z","times_seen":17,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/12/Youre-done-you-downloaded-it-and-entered-the-casino.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.066Z","timestamp":1784715432066,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/12/Youre-done-you-downloaded-it-and-entered-the-casino.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11006\r\nlast-modified: Wed, 17 Dec 2025 17:54:03 GMT\r\netag: \"6942ee3b-2afe\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11006,"size_decoded":11351,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3cfbe44606ae36b9fd1e2e50cee4c6c2","sha1":"9b4b23f51596533acd49aa7edd06f1b719318d4b","sha256":"c4f99522eaea4e62c838dd9437909ca6c9a6e5067194b35c108149e305f6c439","sha512":"c893995d7f60149caca7dd98392f1d1bedd8dbb444b1a9a57a32f49cb7efc39e0cc1d6c18fcd4aed638938ce57e3a268f20ce88cdf453e588f4a9437d628bbee","ssdeep":"192:YwT99DhuJesemCODPych7ChqxC54oTqMlZU+ybcT0e2tVLQIR:YwT9hhugmCO+AChqxC5XTBlZU/Qk","tlshash":"7932afd386abcb89eae1643716a16610fbf9b371561c0177939f43e82b220f374043c9","first_seen":"2026-07-22T10:09:49.021151Z","last_seen":"2026-07-22T10:17:49.146828Z","times_seen":2,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/litespeed/js/95c0e431778f0b9762399dc6d544ac7f.js?ver=4ac7f","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.098Z","timestamp":1784715432098,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/litespeed/js/95c0e431778f0b9762399dc6d544ac7f.js?ver=4ac7f HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Wed, 22 Jul 2026 10:17:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a6098a7-9ed8\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":40664,"size_decoded":10966,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (40662)","md5":"79ddb8f367aff0a471745b1bc34829fc","sha1":"4016aedd7975846e98481984ee1bfffd4b7e51e8","sha256":"15e81a071636c6f2c0a00ba632da780a10bd8d3f1216fae9aaefaeb28ab03c06","sha512":"f31b87ae66bb87aa6b02aeeedb1da0a445434fd5ba45e4e31ea9e33b60157f175a42d1a241e5c7fda195ffcc72d0991c5f662fe9f4d381c61c3b15bd2c119d8f","ssdeep":"768:k4cjy6JZaYSJjv+YfzwLpstNyuGFGgxesKNVhIkYJO2ybEXoHHFC1aRHQpmiVKbx:IZal8OHQpmZNemsECFKAI","tlshash":"e003e8b93a9c90b416ee87ed37abab48e4303961dc0fc8609565dc542258dc70f9bfb1","first_seen":"2025-07-28T04:38:05.361742Z","last_seen":"2026-07-22T10:17:49.147719Z","times_seen":167,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=DM+Sans:opsz,wght@9..40,400;9..40,500;9..40,600;9..40,700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.028Z","timestamp":1784715432028,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /css2?family=DM+Sans:opsz,wght@9..40,400;9..40,500;9..40,600;9..40,700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 22 Jul 2026 10:17:12 GMT\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3408,"size_decoded":1120,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"ea4ef1b58461cc811a47cc9fdcab61a1","sha1":"155779c0daf2ef7c7f64ec41edad480c09da941b","sha256":"40522150a1e943dad5c88314d6a9c235b312d2d6beb893e8cb6b46a6825ed3b2","sha512":"26cc96e07b4c262d39d35758075140d1becd6980401a612d83b34339f35dab7bb2635c51e914a7d07c7f82971ae109966b569263c029e7a275d1f96a6e4d5e23","ssdeep":"","tlshash":"8b61ac81046bb114db572cc122cd7e32ef1f619164549874aafe2888fcaad6e5361b4d","first_seen":"2025-09-16T12:22:54.356027Z","last_seen":"2026-07-22T10:17:49.148391Z","times_seen":76,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":15,"send":0,"wait":32,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/10/rainbet.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.046Z","timestamp":1784715432046,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/10/rainbet.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 13896\r\nlast-modified: Wed, 29 Oct 2025 09:56:50 GMT\r\netag: \"6901e4e2-3648\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13896,"size_decoded":14241,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1ed23d2318b9c5ab6a3302065928b62a","sha1":"d287133a2ea16a1676e9d2be92ac7a944708bef1","sha256":"0d6075fa235556b301bcfd0c02a5f053904924f266ecd944d1b3cf0240b31357","sha512":"8a7d5a2193a4b4cc04e13ed0563ccbb7753906deaceaf23c2ebfb8c92e00ec07e16c6e9cc578dafd6822d009cd15e90a17a52cd8153cb71e49f8f6a767144696","ssdeep":"192:FcLVeAEReygzTKmUhkog0R4G/FRa5ABWlYtxwlkCqcVjlQCr3B167mBF2HL3t:FNtgnjLKhkABWlaCqiZ5336yBFU7t","tlshash":"2352bf5cfdc85247a90634f10f9891a814607bdbce662f0c5f2d8f55f685a63b68231c","first_seen":"2025-12-26T19:45:32.810342Z","last_seen":"2026-07-22T10:17:49.149042Z","times_seen":7,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.181Z","timestamp":1784715432181,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rainbetapp.org.uk\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 62460\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 19 Jul 2026 16:49:12 GMT\r\nexpires: Mon, 19 Jul 2027 16:49:12 GMT\r\ncache-control: public, max-age=31536000\r\nage: 235680\r\nlast-modified: Wed, 10 Sep 2025 16:30:17 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":62460,"size_decoded":63273,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 62460, version 1.0","md5":"4c04ee82dc1deb4f32b244195d258e9b","sha1":"9bd2bc9c6f54075acd20589f87c17a73e3ab07b3","sha256":"ab72fd10c9ac5633c1f9ae4267864b674596062e023458e02973080bd1098904","sha512":"43bd417c75382fbcad7a44c73db7ec8e883bb505b63215ec67488eb205b61acd94031d5740bdf70cf413fcb126ac6a567b4c71831eeb063e5643fa0adc704895","ssdeep":"1536:Hjv9lkTtdw0aS3yPvWdfDSFdW6KK8zPJ86DQMBXQX:Hz9ceS3y2FDSFdRKNzPJj5gX","tlshash":"8753028264d3489c8c8b69d354847f1c707ef88fc1b88995a8e33ca14d4b1e6e85ad7f","first_seen":"2025-09-11T19:26:36.805532Z","last_seen":"2026-07-23T12:33:44.312012Z","times_seen":23327,"resource_available":false,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":0,"connect":29,"send":0,"wait":17,"receive":49,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/10/rainbet-uk-icon-150x150.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.283Z","timestamp":1784715432283,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/10/rainbet-uk-icon-150x150.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6820\r\nlast-modified: Wed, 29 Oct 2025 09:49:17 GMT\r\netag: \"6901e31d-1aa4\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6820,"size_decoded":7164,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3df26e240ec7b2ed0c51b9923ae3a052","sha1":"fdfcf6c6efcf0138141056b20333f34ad3ded71d","sha256":"196b90900fc0ce9f741f6d70ed4606499bacfd19ca94ca1857d2b5c8f915ab3d","sha512":"50a4b8ebe101070c7f2a2b6b5bb25e1801828dd884be2491cb5871079a219efc026551f7d97ce7746f16d254a96c4f49b74469e244a17f38719ea67cb87fef5a","ssdeep":"96:QtFqIK0/dwi+APDIYJlrqNr3NXdXi/Cn34f3uW94o6mbydrNFR3Dd3RdnwZLU93:Pj0FwHAbIYDqNrdN34f3r94tTZzNJB2A","tlshash":"2de19f051eba3c852573af0cc7711779260f82b456a8d51e73e35305092ff4821767b3","first_seen":"2026-07-22T10:09:48.998142Z","last_seen":"2026-07-22T10:17:49.149653Z","times_seen":2,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/12/Wait-for-it-to-load.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.070Z","timestamp":1784715432070,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/12/Wait-for-it-to-load.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 12010\r\nlast-modified: Wed, 17 Dec 2025 19:38:01 GMT\r\netag: \"69430699-2eea\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12010,"size_decoded":12355,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9cb639ed434d73cfe2a30725b11113cd","sha1":"9fef60defa2240be11beefaf4152eef4b5cd722e","sha256":"81312653bae8ccfc7031d5b6b50076a449bb99884be3153c40d430119b2ca5f2","sha512":"dd5d36780d5469edf4ab4f95eca4b948049efd6e73dae9ca9b498b8f1cc38672337143f1431494caf50b9a781914e4286ab3d5d3f98fcb159a9381b35e70441a","ssdeep":"192:4wTNRiQwKXs9tmTICctgsg0Z5Xi8vdJ9knd0OVAAAqWhOYeq2esh2cAr4Mwhplcf:4wTNRoKXs9YcC4ZgGx1vdJ9kd06WhOZI","tlshash":"8e42cf11a379322cf90eb6f28b958f810b789f5d36687dd7c0624a8902547d4d838f2a","first_seen":"2026-07-22T10:09:49.012128Z","last_seen":"2026-07-22T10:17:49.150955Z","times_seen":2,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/litespeed/css/d585fc9af46a9dbfc272487d828ee335.css?ver=ee335","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.031Z","timestamp":1784715432031,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/litespeed/css/d585fc9af46a9dbfc272487d828ee335.css?ver=ee335 HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 22 Jul 2026 10:17:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a6098a7-1993c\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":104764,"size_decoded":18391,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65534), with no line terminators","md5":"ed4470522ecc3850e44a799e39df7e05","sha1":"aed774b3691c1b84ea118af00baa15d2262f0ca7","sha256":"6ca47e15987680d9a626ca66c6d8077c1bc6d33864a7f85977c970018e2298d4","sha512":"38048273550c0237540a4161870c93b37c6732079ea83ead9ebc660c112241b3252db2f7b7ba090164c5fc7eae85502a31139d64d13c6e3f3b86532674e9254d","ssdeep":"1536:Z1zIKNTyHHa8SaEDeEN2co4tlJ3SYiiuVENM6HN26KG+P7x5Pz:TZ3tz3SYiioENM6HN26KF5b","tlshash":"f7a392c7f1a03518d467c61da0d07abe2a6f4641e3269eebf8277bb487c92c70552e0d","first_seen":"2026-07-08T11:55:32.50655Z","last_seen":"2026-07-22T10:17:49.151987Z","times_seen":3,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/12/Go-to-the-Apple-Store.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.041Z","timestamp":1784715432041,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/12/Go-to-the-Apple-Store.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8132\r\nlast-modified: Wed, 17 Dec 2025 17:54:02 GMT\r\netag: \"6942ee3a-1fc4\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8132,"size_decoded":8476,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"83635ecb3a5e7634dd62572b2425b9d4","sha1":"acd963945c73d06f2f496a300c538a24f59b75f8","sha256":"1c1c8465afc7b85d95f9a1624f32464779bfe1340ed4ff3c7fbec5c723da9f89","sha512":"de952cfd5d6b43d726a6ab2b6e3622b190db734ef926dc1301efcff2c790ee4806ad569985fe8f9b693e42dbb2901972ff3c134c35c87974d5e46b7dfddd3087","ssdeep":"192:rwTpMbvt2GPHf/W3HQagu1DVeFdC+Mu7CTqMIU1Z+0cChfOpvVFLALs:rwTpiL/e5r1hMH7CWMIU1ZD7WNVSs","tlshash":"d8f19e950390a028f5151c34bbaf0fe2b9a8272255c2b74765e607f626706d77cec7d3","first_seen":"2026-07-22T10:09:49.000462Z","last_seen":"2026-07-22T10:17:49.152644Z","times_seen":2,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2026/01/hedesbet.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.054Z","timestamp":1784715432054,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2026/01/hedesbet.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7740\r\nlast-modified: Thu, 28 May 2026 08:28:02 GMT\r\netag: \"6a17fc92-1e3c\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7740,"size_decoded":8084,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"75180b1eaa2a62548c31fb1e199a6134","sha1":"f120776b178176b77a93b3a4f47a2722714a7409","sha256":"278162082fa697426b036f8f11bb78012f404759928223ca73fb1c6c04b347c2","sha512":"04bb317d9c6c38a2a639c3cc7a0c188cce780e1e1e9bfd4fc12daa2d327bde54f57b0a9f37ae98790b277cb1570a1bcd8bf31e63de5c10acee0e58de4b0e8e59","ssdeep":"192:W3wYIy6JGTVon3OOminipGWdmByzRStXrILnMd:MwPy5Ro33mingGsYbtb","tlshash":"4af1adf906beef69ea17c931f01e974a13e8bb00de83ab0a721051061e15483bd2d173","first_seen":"2026-06-01T17:33:44.789728Z","last_seen":"2026-07-22T10:47:32.913388Z","times_seen":11,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/themes/starter-kit/images/rating/badge-4.svg","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.055Z","timestamp":1784715432055,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/themes/starter-kit/images/rating/badge-4.svg HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 22 Jul 2026 08:00:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a6078a4-5fe\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1534,"size_decoded":1094,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"da49c60a038c21ad060f0b53ff910426","sha1":"174fdc729062994bb104f00c9c6072a0cf4faccc","sha256":"addd89150ca262be3c0335ee993d4559fb1d5ce30ac6c25c6c3bdccb7c49e9c5","sha512":"38a85e0737612e812633a5b3f7f66a8bd9609ff6d24011b479ad55027f61373b54cecb7750d75d45fd2765931456920866eeafde617bc6e6d018cdc206d072ab","ssdeep":"","tlshash":"cd31957ee10d2c2af12885bcae52d478047abdfb4cc2000044e1b9abd0a24c60cebe5b","first_seen":"2025-06-05T18:04:56.85468Z","last_seen":"2026-07-22T10:18:57.071232Z","times_seen":31,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/10/d30fae07cdadcd4712ac0fd8c14d765d.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.057Z","timestamp":1784715432057,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/10/d30fae07cdadcd4712ac0fd8c14d765d.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9328\r\nlast-modified: Mon, 24 Nov 2025 06:53:17 GMT\r\netag: \"692400dd-2470\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9328,"size_decoded":9672,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ae275866883e5b15cbb5c79a65e97338","sha1":"d3cbff9a71c82ce3891050f9cbb77c90a0377a5c","sha256":"4d7e2904fcd00c0b9cada8efba452ec3c43e3891bcbb1318bc43517e9d2b4e81","sha512":"3a12ef2456d1d5b4b6cccddfd239ff1266de13aa2f087ae2542647b2f6c44f12a94297bf88eaede7ea5d26f957bef1e9085432d69a41ecc1b337b3de2f17ac5d","ssdeep":"192:MwTG6LAxt0f6fkxmsEyprhTv43WghenvyWG8UOherICqhKgl7m2k4YX3HHu:MwTG6LAqQemsEqpvsWg0aWG8UOherIj5","tlshash":"b012af07f7655bf4e16f27f0607807e0e5d3a305781376aa11854bf14fae1a0819dea2","first_seen":"2025-11-24T12:48:18.66358Z","last_seen":"2026-07-22T10:18:04.966974Z","times_seen":15,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbetapp.org.uk/wp-content/uploads/2025/12/Confirmm-uunknown-sources.webp","fqdn":"rainbetapp.org.uk","domain":"rainbetapp.org.uk","tld":"org.uk"},"ip":{"addr":"103.217.252.135","port":443,"asn":0,"as":"","country":"Australia","country_code":"AU"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.069Z","timestamp":1784715432069,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbetapp.org.uk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 07:39:11 GMT","end":"Tue, 20 Oct 2026 07:39:10 GMT"},"fingerprint":{"sha1":"77:78:64:EB:31:18:59:B7:F6:DD:3C:4B:ED:ED:CE:2C:A3:7B:B4:C0","sha256":"72:08:C5:E7:0C:CB:8F:17:6F:63:0F:60:6B:50:72:B2:19:50:95:33:57:BE:33:56:FE:71:AF:F3:60:29:A4:D3"}}},"request":{"raw":"GET /wp-content/uploads/2025/12/Confirmm-uunknown-sources.webp HTTP/1.1\r\nHost: rainbetapp.org.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbetapp.org.uk/\r\nCookie: pll_language=en; _lscache_vary=18306a3a2c9305957a94377e6fc65dcd; iu_popup_unique_name=GVgRBVsdH1gIGxcXGV5WHlI=\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 10:17:12 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7902\r\nlast-modified: Wed, 17 Dec 2025 19:38:03 GMT\r\netag: \"6943069b-1ede\"\r\nexpires: Fri, 21 Aug 2026 10:17:12 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000;\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7902,"size_decoded":8246,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cc6d16cad58e364c217481ecbf6a0f03","sha1":"9326498302d12dd7c4174dc3193f3b46ba9e4622","sha256":"e1776deefc1d6b0e92eb90846531012889cc2765ab3e8752fd8ded20607302de","sha512":"d299a223aa1c06fbd6397ad1137eacdeb26a6c4393d2ca334cd485bdcb645e711a3a9aeb986aa39aac0468d3d554e3464d131bb94f722dedccea84667d210005","ssdeep":"192:swTPCXIRRYm04a39OyZM4B9c0yDzWTSRYJdB29FGFS:swTPCY0m439O8SeSRYqiS","tlshash":"f4f1ae109b459fa9e3303fbc210821a2b19dba320d2cdd1269c58d25093d4f7b95a6eb","first_seen":"2026-07-22T10:09:48.978659Z","last_seen":"2026-07-22T10:17:49.155774Z","times_seen":2,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rainbetapp.org.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rainbetapp.org.uk/","date":"2026-07-22T10:17:12.187Z","timestamp":1784715432187,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/dmsans/v17/rP2Hp2ywxg089UriCZOIHTWCBl0-8Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rainbetapp.org.uk\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 62460\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 19 Jul 2026 16:49:12 GMT\r\nexpires: Mon, 19 Jul 2027 16:49:12 GMT\r\ncache-control: public, max-age=31536000\r\nage: 235680\r\nlast-modified: Wed, 10 Sep 2025 16:30:17 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":62460,"size_decoded":63273,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 62460, version 1.0","md5":"4c04ee82dc1deb4f32b244195d258e9b","sha1":"9bd2bc9c6f54075acd20589f87c17a73e3ab07b3","sha256":"ab72fd10c9ac5633c1f9ae4267864b674596062e023458e02973080bd1098904","sha512":"43bd417c75382fbcad7a44c73db7ec8e883bb505b63215ec67488eb205b61acd94031d5740bdf70cf413fcb126ac6a567b4c71831eeb063e5643fa0adc704895","ssdeep":"1536:Hjv9lkTtdw0aS3yPvWdfDSFdW6KK8zPJ86DQMBXQX:Hz9ceS3y2FDSFdRKNzPJj5gX","tlshash":"8753028264d3489c8c8b69d354847f1c707ef88fc1b88995a8e33ca14d4b1e6e85ad7f","first_seen":"2025-09-11T19:26:36.805532Z","last_seen":"2026-07-23T12:33:44.312012Z","times_seen":23327,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":23,"dns":0,"connect":0,"send":0,"wait":35,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}