{"report_id":"f13d0370-1747-46c4-8e6e-50c3c40a8fe7","version":0,"status":"done","tags":[],"date":"2026-07-22T09:58:53Z","url":{"schema":"http","addr":"rain-bet.xyz","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"172.67.210.77","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"rain-bet.xyz/","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"title":"Rainbet Official: 100% Bonus on First Deposit - Canada Casino","dom":{"size":696345,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (62784)","md5":"f3fc5d22f6e979bb5a149c6b57135961","sha1":"fe696ad390e8a7b6887e60e313273e9e86debd7d","sha256":"d4fd7a1459bc212cb2976c393c4bfe06d306310c03b702224e7c9e1b9851b628","sha512":"33bf991568127e217152e35f9efafd18a1ce47ddd1ca412f03514434af14507dedaefafa27db05a3c4db1130c3cee7b1e505ee711c8dee289908daf2fa25f5fa","ssdeep":"3072:TmQedYY2TTKHkjDNI+kI4qdbQbCbFbabJb2bZbZbJbu:jbNyQl450pp5u","tlshash":"f5e419f145e495786443e3f2e210396aa726b8afa91b4dc0f75c978c8f93ec25c2395c","dom_hash":"domhasha6536bc6f7d78ee8113781252a1749ad","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rain-bet.xyz","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"172.67.210.77","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-26T09:58:53Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"rain-bet.xyz","ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-04-09","domain_rank":0,"first_seen":"2026-06-09T01:22:56.829766Z","last_seen":"2026-07-22T09:56:20.402069Z","alert_count":134,"request_count":67,"received_data":1759023,"sent_data":42486,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rain-bet.xyz/","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f40a127715174cedb653ca643c42e00e","sha1":"411a0235a6f75ec78f5465f1202dc0307a3ddec6","sha256":"ff228c38483b4c22b8534f64b73e014a8d7d28a089458eaf73eb7b0e8330c455","sha512":"60d233e1334b0f734d1b6ef209523cde9ab2bf374aa30770f398e4aa03723d3bf6dacec88ffed165fb1d8ac04ce595d513f01e4a620dad2f7810481d948e3827","ssdeep":"","tlshash":"ecf05c2cc55845a90447ba999469051bb88f41972dc034e9fb4cd5440f25f5b3efb64a","size":484,"data":"","first_seen":"2026-07-22T09:56:21.403886Z","last_seen":"2026-07-22T09:58:55.777783Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ecc6478d530c8f5f68e66ecbb15d3674","sha1":"6d6f7792b0a8497217c78305dee7c66f3203310d","sha256":"95325de73d3ce2cbc50601a5a280c80b1020c75344774f2c21484c883b96e3fc","sha512":"6a729c488e3775f67e2fb71b3cde956bfff9d30db905df1d59dea28d50b7348d5d7de9a780ddc1e1f324a47a9a950fc7d25cac88d4591949411fabb84bf9ed25","ssdeep":"","tlshash":"16b012a3083a02400a4113d414835000485c19d5318280d2ff4d40001f815c700327c8","size":93,"data":"","first_seen":"2026-07-15T07:58:47.850003Z","last_seen":"2026-07-22T10:07:05.814988Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"de4b67d39b47b2a6d5f6b51204c069e5","sha1":"633b20d20ec515350ecfa6989b1d90541101d621","sha256":"0fb05fe9107a51ea00622934d152b23a479e79f2bf99d8336bff8c05d3dd7e3f","sha512":"78b9b3a4964f26d851ca16f4c1819dba7558417bed3d254a57575fbcfd9a1c6b02d7105876507a17f703086aca66de9c69b26207e01a07c3a0ba785d78d696e3","ssdeep":"768:P9tZRDpIk6bdV2BilJauvix1MSXbW6Xt43yjMXptoDpkzhzaEubvZ8GVmSMpeFKx:dRDpIt7oDpkOSSnJJpk","tlshash":"34c2f821b664147940da1eefb18bb754be3614827445f0d1a97e8c881f93d8331b6fbe","size":26402,"data":"","first_seen":"2026-07-22T09:56:21.40583Z","last_seen":"2026-07-22T09:58:55.779185Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-23T11:25:05.719537Z","times_seen":404310,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rain-bet.xyz/media/diamond-explosions-7-685530e018322021227837_195x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.413Z","timestamp":1784714305413,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/diamond-explosions-7-685530e018322021227837_195x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:37:02 GMT\r\nx-rgw-object-type: Normal\r\netag: \"e20d44a2e558eb4465523f39a4dad80a\"\r\nx-amz-request-id: tx00000dacfe1e320b22732-006a6093a4-2d70d6a5-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=V9P0c8HvRofgw%2BJ%2ByrYSApY2uLI1e3%2BQqe8DJekr0OJmh%2BdPLesgnP2zWiH8mUyt1ZIny7uanJifDK8kpdSIreUSE6h1IxPGtF%2BSZQzl%2BnIXlZRx1YGiHslPxFavtsw%3D\"}]}\r\ncf-ray: a1f19638cc465a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9238\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9238,"size_decoded":10197,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 195x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"e20d44a2e558eb4465523f39a4dad80a","sha1":"139963dcb53be589f9482fbb888d671f9042f53a","sha256":"20117958419012b31c8b873e23b9295b6fd8d7b6cdab310cf34566c73d877837","sha512":"a835df1c6b524f9798476cc6e2679e55f209d964065e7d88d02240abd6dc0f46dd1269c6501b9b52cd495861f97b8e651c9426ce9738b871460d840be5d4a661","ssdeep":"192:AepNarOYfom0ATyAuH42xhiqTvmltmYDD3GAQmZ4qWJA7:5ErGBZ42xh/Wt9GLmZ4qr7","tlshash":"2f12c0d357f560f97aa38ccc0dbb058864c497f3929c30116783add78d2098da5d0639","first_seen":"2026-07-22T09:56:21.361126Z","last_seen":"2026-07-22T09:58:55.721516Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/22955-0-686d222726fb4342948753_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.284Z","timestamp":1784714305284,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/22955-0-686d222726fb4342948753_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:39 GMT\r\nx-rgw-object-type: Normal\r\netag: \"de0f20a090ac47853eb326ff8dd44bc7\"\r\nx-amz-request-id: tx0000022dfd6171f424eb7-006a6093a4-2d70c80e-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N4LICIPbTFLnPrcklewuFYSEQRRcWCNROpPnopQhzrT1pSl6n66LnprV3dVT3CGNHc%2B0x6rACrW9TNsnEGUQu3Kl%2Fa2TnW4qrV5F90OiHDdXjCsSJMwN%2BFy24Qshd5o%3D\"}]}\r\ncf-ray: a1f196380c115a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10110\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10110,"size_decoded":11064,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"de0f20a090ac47853eb326ff8dd44bc7","sha1":"194f7675e6512a7f58bf9a098b9146d2f4f14299","sha256":"42ff72295b3e9dc28c4411c85e020d34d87cafbb5624c9f43ed13a914b369cf9","sha512":"5547fe0c7aa0d985e7b84280708a8ef0f572949ee64c2c27a9847e7864739e8831b810ad96ebba1b9046e829491dbf7967de3003648b4c1845da7fd9e963d004","ssdeep":"192:kUKhoyX/PvxQQMdmeoBiAhrpAa6pS0iKiLdfxmlDcLKWSAjE30Uve8WtOhOGnO:JyX/PvxQJkDTrpAaWqmlmSAQEUDWtKO","tlshash":"56229f2099317f0ed9b9c1f896214f8bb94a91a21c17bd5d4a1fb5c32c0156dbe17a0d","first_seen":"2026-07-05T04:13:25.047141Z","last_seen":"2026-07-22T09:58:55.722264Z","times_seen":4,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/european-roulette-christmas-edition-6859090264864990214358-685d525364433421156963_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.386Z","timestamp":1784714305386,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/european-roulette-christmas-edition-6859090264864990214358-685d525364433421156963_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:39:02 GMT\r\nx-rgw-object-type: Normal\r\netag: \"519ef4a34d06df7ac5ea25d024792fc7\"\r\nx-amz-request-id: tx000009f538766cc7147be-006a6093a4-2d6ee1ef-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bU6wO3ZjqdFdReRbyJhkrxQD0%2B7jwg25Vm1ahXL3%2F5npyN21HutWi0YxYS4bk3BTIaNO6%2FCUw1SjkeNl4hgtPcbJGKd0booL1wCptU9z5UmP%2FcKH4MH%2BLIgFDILoQT4%3D\"}]}\r\ncf-ray: a1f19638ac365a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8612\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":8612,"size_decoded":9569,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"519ef4a34d06df7ac5ea25d024792fc7","sha1":"2a84c5f8ecbfd6af97a32d8e8bb95fa8743e8d7b","sha256":"302008f490ae21692fe08dbdda0b66d2a8d7385af2c85a41fb28ff77ae887360","sha512":"f6ab832931f6e85ac5d7e9b0b405d65cefa85e679d46f42cde4b789c35de2edafb7ca51888cda8de3d9703d9cabd58f04c8aea398651ba0dcf2a0297949c9469","ssdeep":"192:Ds1K1p3jwP0zX/eAjsw0Y8IvNBYE28YL69Pc:6KrTwP0Vj0YX1B+T","tlshash":"0502afb6f137852c9ec15c52784a4f9944d943c4e9faaf8ececa76369d0a46b1f48108","first_seen":"2026-07-15T07:58:47.823566Z","last_seen":"2026-07-22T09:58:55.723164Z","times_seen":3,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/blackjack-neo-6859697ee55f1774239777_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.435Z","timestamp":1784714305435,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/blackjack-neo-6859697ee55f1774239777_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:41:44 GMT\r\nx-rgw-object-type: Normal\r\netag: \"40b9dda5f42dabec731492b8a442b18e\"\r\nx-amz-request-id: tx000006d289b2c55265893-006a6093a4-2d7890f4-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JUzpw0pCZhruv9SecXgu73vcm8AZkVMR%2FGg%2BlNffgHaTwkw2xDVi6VXDwBJF%2FJRbnCADiuJaxIL9kECw9ldHHX8Q7GttQsgPZIt0AffJhnsbmzJbxOu0HMtMRquhDD4%3D\"}]}\r\ncf-ray: a1f19638fc585a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5966\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5966,"size_decoded":6919,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"40b9dda5f42dabec731492b8a442b18e","sha1":"2de1b8be295dfda32f29536452fbad2342639a1e","sha256":"72700e0f20be4a9f0891b2bc11ca560abaf34bad1c27fabaa7f63e54d8735c2f","sha512":"115168bbbd09e178eb159347f0dee68db8e7c4516d60f194320b6a7dd6b6080f6252a33d743f08dc98f9bd8650a9a5e2efda9d2d610071dbb9fa0f793b8ad760","ssdeep":"96:EYsmFzA+hj10CUCC++PJhOW++Ejm3ykMTBREvo0H17T1oWgD47L5oqHYq7xxuVRz:jZ8cJ18++PJhOb+EjmCkGngJaI1oqHf0","tlshash":"f9c1af8d654c499db99d3b8301c70360fccd1aa9e5b13366d0180abc095d3d63b83a91","first_seen":"2026-07-22T09:56:21.391907Z","last_seen":"2026-07-22T09:58:55.723744Z","times_seen":2,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/fan-tan-6855092287354123035349_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.338Z","timestamp":1784714305338,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/fan-tan-6855092287354123035349_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:36:02 GMT\r\nx-rgw-object-type: Normal\r\netag: \"95dcb3bfb1880085b1794b7b311b1b59\"\r\nx-amz-request-id: tx00000e3946b2f3bc3c428-006a6093a4-2d6ee1ef-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n4s7c3DA%2FXiVVBsw7EIP0bf3ssB8Tk2IfCbQ%2BW05ePw5iLHDloVtLm6RSPQh9UB9UJoTSLyBzggQee1iiRcSy9eKSMlRvTXSUxPYJO%2BgCbAxrEp6CskpoAvNsYlKHg8%3D\"}]}\r\ncf-ray: a1f196385c225a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4770\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4770,"size_decoded":5723,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"95dcb3bfb1880085b1794b7b311b1b59","sha1":"cbb08a030f9cbdcdd28d9ac4289f020bc3279e95","sha256":"e414874d009f93114ec1d53d810b11e3c571bb7a2570c11d5cb3ef8f28fe4fbc","sha512":"f4ad12433dddc7321c51be9062629f94ca35664feb0f3e7df19c4c2b1b3485f6c9464613b830825b4bf14179f75ea768fc0f3c3cc1fe96ed3fb5a4ae4c2c0ddb","ssdeep":"96:nPGt1Jwlo+/0y7ywlfrMaF7cn/oaOFrIqOTNlobW4B9Ub6COyV9jq:ut1J0o+/lIY7cn/0CX4grl9W","tlshash":"c2a18e059c0cca878417390e7db2a39122ae7bdca07513c1bf9ded991a7cb9bb1805c1","first_seen":"2026-07-05T04:13:25.065764Z","last_seen":"2026-07-22T09:58:55.724401Z","times_seen":5,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/bubbles-685906e8e1580672932607-685d51c6e65f7863702561_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.374Z","timestamp":1784714305374,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/bubbles-685906e8e1580672932607-685d51c6e65f7863702561_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:53 GMT\r\nx-rgw-object-type: Normal\r\netag: \"af35c6fd6ad060d61848976f29566a70\"\r\nx-amz-request-id: tx000007c404bfcd17a35d3-006a6093a4-2d6edb8d-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F8zUEfQkbUkgup2z6XrUGLEBMEQ1a%2F5x%2Fqrvq7xBtJioZ8dzjM4Zdpu9IjvDYbWeuv0vGG2FUw40zcmzeHaryqdIEU7EHUnQd9UYZSSP1REdie17qOOHcCzLiAHMx4s%3D\"}]}\r\ncf-ray: a1f196389c2f5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4642\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":4642,"size_decoded":5593,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"af35c6fd6ad060d61848976f29566a70","sha1":"fa72b8d4c7cbae1a777b784d228a44ca569bbc18","sha256":"db9c234b283466478f1e871978f03320505cc4cad567ad592b0ab9bd22c3cff7","sha512":"e20ee4ad9d738fc590a8103622a1238f7aebb7e6b4d606ce1c4f60d550d872f59f1fa6dae7a3736d7a92854db01c3132caf4145bb2c9bb8ab69cc4ec1a97b811","ssdeep":"96:rBtimgIpa6wu/uQkFFBwvakAt2Cb/Ef1byrOQj+KQe1DfY2R:rByIpa6wu/CFXwBijzYNC/FQuTd","tlshash":"0ba19e2a8f6d779c1b1d040df480f04ddda687fda798ebc34ba3d72096618ca3010961","first_seen":"2026-07-05T04:13:25.044051Z","last_seen":"2026-07-22T09:58:55.725272Z","times_seen":4,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/wild-bandito-685571db4138a123265585_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.399Z","timestamp":1784714305399,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/wild-bandito-685571db4138a123265585_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:13 GMT\r\nx-rgw-object-type: Normal\r\netag: \"927c18c65d7d3b361d35c0b2fb8852e2\"\r\nx-amz-request-id: tx00000ebe3a8c02f2ccb98-006a6093a4-2d6edf5c-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pyTjWaZOstEMdQ4HTGaiW2oB%2FGGak1b0RU7UshbfuMslg0NxyGodBiKJr%2F80ZW7zZDu9ElyTFWG6i2mPuziOgXIomlSRacD681yYjNQy5kCNrkKYgJnapEkeCuO5VF8%3D\"}]}\r\ncf-ray: a1f19638bc3f5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10922\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10922,"size_decoded":11874,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"927c18c65d7d3b361d35c0b2fb8852e2","sha1":"d95a6b626aabf1e8c97249839347cb7e17c2c5cb","sha256":"0cd333dcba1a7bee262bbe0a3685201ff093a2d161ad69d4af77c02a94cab214","sha512":"ef147d277bf1bb6fce59033e43df0454350d3051f8d11e93eeb540fd3f97103ef4c1ffa49b549c6fded95cf2c156445ce926f4483b5ac69103249139a1534e99","ssdeep":"192:bLVXqcy21lYWgfLMggq1KdMqYu10w/XD2SwuLhTOhsWcL970OBfB:bL9qcrtgDMZ0YnKIDJJ/0OhB","tlshash":"4c32cf45dba28164cb039ed71aba43f33a8f263182576b369cfd2d31cb1d5d1da40ad2","first_seen":"2026-07-05T04:13:24.96962Z","last_seen":"2026-07-22T09:58:55.726561Z","times_seen":4,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/high-low-dice-evolution-vip-68596a4e6f5ae752928289_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.417Z","timestamp":1784714305417,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/high-low-dice-evolution-vip-68596a4e6f5ae752928289_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:41:55 GMT\r\nx-rgw-object-type: Normal\r\netag: \"799873d3dad302f0758634aefc294377\"\r\nx-amz-request-id: tx00000add933d6e652c0a9-006a6093a4-2d7890f4-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ivdy5BsRSPBXH3vZHmIrizxGPjeCervD3yIVtppFNRx1MVriBmcgSsiPAgP0dClr3x6JjgF1c%2BdOQ2gwpqIBR0xAmOaYb9fSn%2FM5K96JJ4nQiuLknuyvjJewz%2BPzOfk%3D\"}]}\r\ncf-ray: a1f19638dc495a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7204\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7204,"size_decoded":8157,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"799873d3dad302f0758634aefc294377","sha1":"323b5db5f235daf1fb6dcb03d7974a0bd806a5fc","sha256":"3a0a6a8d09d57758fefc8bd936688070ba74a85c6358018ba564d8d869d499b3","sha512":"f3c1c474ee0cfad3b36729a24c618ea5712ac5ebd3ef66de12178ef7cc1d34d33c67b94e7d358e41babb7b4765e5910e8fd0ae5258554e3c317c813b9e8916ea","ssdeep":"192:sUSHz24ek50hugEjOBPxQWlzPPwsjIm/8xPHIrnp0:sLHzQhubjOBJ7zPPs/Wp0","tlshash":"7ce19e8d52a69304ad2fa642474c3c3dc55ee05fa45a3f62e7d8f3e55b620fd7009472","first_seen":"2026-06-10T04:30:14.152368Z","last_seen":"2026-07-22T09:58:55.727115Z","times_seen":4,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/floating-dragon-megaways-6859407a4938f024897211-685d4e56e70fe874054295_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.419Z","timestamp":1784714305419,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/floating-dragon-megaways-6859407a4938f024897211-685d4e56e70fe874054295_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:40:07 GMT\r\nx-rgw-object-type: Normal\r\netag: \"c52e38181192bca36b37e7d01898f078\"\r\nx-amz-request-id: tx000002d32332d40b383a9-006a6093a4-2d6eb3ce-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TeDpHE7Ffu2MYlCRwvGCnWjU31WsHOdzppHH23vV3Z0jhYyIEReIDPXfbD%2FWtUOGdrM4OQlmvDJ3DoRPQvpdxsz6jUc%2F%2BwjE92vpuILEmYmXLwPz2A76eyoOjgxkoLk%3D\"}]}\r\ncf-ray: a1f19638dc4b5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10672\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":10672,"size_decoded":11626,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c52e38181192bca36b37e7d01898f078","sha1":"f34980e39faf3f21a4c8b3ac155feb3a75878d3a","sha256":"22189dd77e1a53cb1383fb7cd7cac518766d3285bd5218b37f8024fdcfc8c881","sha512":"472213141914bb5c1356c9d3b511eee9bc1d7be4cce842d9552ffc84f79f6d10913ad25f8241ff2bd66a0eb50b8079b86c8afb4798f4798961dce79270318010","ssdeep":"192:m2jBJV3NEYrOAdWaSx3OI/D2OFqxWJ6BdF/2aQgxPamqi95buSj2m1:m2jjVdGcWa5S2ODJ6+5gMmJ5rKm1","tlshash":"6022afa05e4b3e53fef3a5f346c5bd07d92d2cdd89a439b7381b04626b2cd636580464","first_seen":"2026-07-22T09:56:21.352568Z","last_seen":"2026-07-22T09:58:55.727939Z","times_seen":2,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/side-bet-city-68558db535a5a412961403_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.298Z","timestamp":1784714305298,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/side-bet-city-68558db535a5a412961403_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:37 GMT\r\nx-rgw-object-type: Normal\r\netag: \"7b863aad129a846a772454153d552388\"\r\nx-amz-request-id: tx000003aa493b72b2a58fe-006a6093a4-2d70c80e-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NcleaP6ztignxfXxmsr%2FGZp2s2XcpLjM%2Bu6oZgQkiLD2rE1wgDd2sku%2BqYK0HdwpF2DmXgQJMBjr%2B7c%2FR2mF7IltQKzaBInwNHqxgz5uInP3TydnTuoHs7GfBtKLJls%3D\"}]}\r\ncf-ray: a1f196381c135a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7820\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7820,"size_decoded":8777,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7b863aad129a846a772454153d552388","sha1":"8d414687e95ac6a4d024fb64ad2cb52c06cdfca6","sha256":"cd78c36feba75064d878ed5628a14e65462715951375faed1e7a78484640b7b3","sha512":"b58c131153f7305867951a22f4012b811025056263bab2b23063702ed961c11d14dfe1b76c7cf7ab843e9b7e618b206256f586b1988096ebbc929e78dbf72114","ssdeep":"192:FangDkTtwqc43NN5Cy5oe6lv+tq/3BXlV:FanUkTtwq3L0Jv+tqvplV","tlshash":"74f1b06fcc2674b35b4c47843aadfc90f17606d24f099b0003ad32b4ac77b842d815ae","first_seen":"2026-06-10T04:30:14.126737Z","last_seen":"2026-07-22T09:58:55.728626Z","times_seen":7,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/fortune-gems-2-6854fe6d1574a045407987_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.396Z","timestamp":1784714305396,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/fortune-gems-2-6854fe6d1574a045407987_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:34:49 GMT\r\nx-rgw-object-type: Normal\r\netag: \"498bb57446094a9777552aba2635c3d6\"\r\nx-amz-request-id: tx00000ce198334a1872e91-006a6093a4-2d6edf02-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=V%2BcfMKwIc47fQ%2F5X3FHYk79ItOPb%2B5Yzbl0X9c4%2B29JWZ1WYpRb4awZGFJ%2BYjvN8Be%2BreFfQUYjoTLOp7zYAqZfzLuvo5nrBCs0hLxezE4ZuzD8ki3hfdQBwpMdwS60%3D\"}]}\r\ncf-ray: a1f19638bc3b5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12738\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12738,"size_decoded":13698,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"498bb57446094a9777552aba2635c3d6","sha1":"094a01fcec3eb092c9bf4607c8cfe1bb0c5971dc","sha256":"e1ef08ff6c890025ae351c3b5176b7dbe9467f4829d924d1dcd13638a67d5bf8","sha512":"2751b591c15299203d88ab989769ad94ce5e86c8b98ff24c3f5c83624118d773572a1fc9bb5933a1157c4d1f02f0f58002027fcc22e176f80be1bf5133f1dcb8","ssdeep":"192:jAwuH9NQFhKIgmCuByZrIRc4MfCqu3DfW5Mk0Jd18vDL1Ko3sIZ8W6L12yxX:j+LQnYiykigD6+Py1lsIg8yh","tlshash":"5d42b0e4c4d7da8e454d915c8a46c404a9e88af7f84527ed8c2d22f6bbfc53f48b8171","first_seen":"2025-12-08T06:56:23.248417Z","last_seen":"2026-07-22T09:58:55.729145Z","times_seen":5,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/american-blackjack-68595f60da829249266029-685a495344ad7679121437_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.434Z","timestamp":1784714305434,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/american-blackjack-68595f60da829249266029-685a495344ad7679121437_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:42:57 GMT\r\nx-rgw-object-type: Normal\r\netag: \"8df161e7d927459b652d8a25c7a7de57\"\r\nx-amz-request-id: tx0000028a989af8277483c-006a6093a4-2d6ecf61-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WZTAPxSwe6UNkWXdX3psAwFBQgptzPUiv5piCxsnfZTerxfCHA2plKJtBSgB7bsiMi5NLD8V%2FSftg%2Fb%2FjSk7QHjGQ9sNfwGLD5cxMQKfAUJHg%2BKokOHME2MnQ7hwdDc%3D\"}]}\r\ncf-ray: a1f19638ec575a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7962\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7962,"size_decoded":8917,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8df161e7d927459b652d8a25c7a7de57","sha1":"8097275482c816497b74dd3850a9bd7bece6d72b","sha256":"92c307460e88296feee197ec289362eb642e3782ea478f2fed8dbb5e10441f79","sha512":"445de7fe6b9a2539cb820199d838463bb3463e19ecf1ceec63502a81980821a50d47543ce0f02da41e6303731e160fcfa3b2b420362d73034c27cd384d6d0b39","ssdeep":"192:6A1M2twdBLK4htQIfxW5Gm/9625ABruFMEeQalHxwBz8RSaskU:6A1Mqwd5ht1fY51/552KM1QalRwBz8JE","tlshash":"0df19e27c264b16ea3b383d76377298f6e5494480478d939b528702bb68172784dfdca","first_seen":"2026-06-10T04:30:14.100798Z","last_seen":"2026-07-22T09:58:55.729702Z","times_seen":5,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/mega-ball-100x-68558ccebacf4483614035_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.324Z","timestamp":1784714305324,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/mega-ball-100x-68558ccebacf4483614035_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:30 GMT\r\nx-rgw-object-type: Normal\r\netag: \"0bc832f00b83a1651c559fb250f4cb48\"\r\nx-amz-request-id: tx000004e58ac9705f47f9b-006a6093a4-2d70c548-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7VkOJVTZNDMUQoCI6X3TZf5xMUBAL9QOSh1nnpzgkvRIbSlOdzI94zx%2Fm55a0sxJcoKtVaEXi4x%2BePO5fxxv%2F5ml845B0GWh9Dsu1aUTqr7jnfnUC4VoXi%2FgNMgAmwM%3D\"}]}\r\ncf-ray: a1f196384c1e5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10484\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10484,"size_decoded":11440,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0bc832f00b83a1651c559fb250f4cb48","sha1":"146c1c0c92e62e65c6d27f8a99ec6f3aa6f27aff","sha256":"98e479cfe23bb406ab8be1a02517ba8d45e3ab79c528707bf6dea6cfaa7b8bb1","sha512":"24fd98f28da951c5588447974e3179b09e4bfc2d21d15dd39cac8568812101d14026a5bc57bc334bb0e3db5030b7a6bd6bc23c81cba5a47a7c9846f141493118","ssdeep":"192:Q40lSmm59C3Coxm++2kUv/BHCYR0XTAhvB4hXBbnEn1wwgsBC5gjDmHbsRTpW:30lrm5UpYU3Bt0joyhXBbzwVoguHbsRM","tlshash":"3422c0da08c9d8c82343bfb1e20cb441742d9bfae9c3e1a439db9ca6d5cca511603dd1","first_seen":"2025-12-08T06:56:23.213218Z","last_seen":"2026-07-22T09:58:55.730286Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/crazy-crazy-claw-68590791d1c31721086082-685d51ec1d472141836872_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.379Z","timestamp":1784714305379,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/crazy-crazy-claw-68590791d1c31721086082-685d51ec1d472141836872_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:55 GMT\r\nx-rgw-object-type: Normal\r\netag: \"984379ac269d4f60d422b1d62dfa238f\"\r\nx-amz-request-id: tx000003f6f835c6675129a-006a6093a4-2d6eb7a1-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p8iXWWCyAKQJfcTkNTEAEJejJVo%2F2WWZcv%2FYwmdHbmOHjM%2FXnOpqNSbxUl0GUVdAPG2vYVf2Me2IFaYOidDknTVFdKhxJvCqo81BJ4cyBq5tRJY25vF5QOmtZvjNTOs%3D\"}]}\r\ncf-ray: a1f196389c325a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9104\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9104,"size_decoded":10057,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"984379ac269d4f60d422b1d62dfa238f","sha1":"cadf073924ca57134558c901a3b7dde2b0cbf3d8","sha256":"663f51c4c054c9888daefddd7fd10ca4aa415166dad2d834cf3027febd3b2c64","sha512":"38110b8a422966f054944761cd0d2670762c03503c3f34e98a87ae2e3ce158e5b37464005ff8130448e11a0b5852688a7b9839656120f5222ada1163d3fe51b8","ssdeep":"192:4YUW2vHNGW+FEW6rCHZrqVD9gDij0tGS9Odl6lLha:44IHNdE5xqVCDiIkSykL4","tlshash":"b912bf541470567e58dd146a0ed671f92016e9e6c31b900e60b17df60886cf3bcef1ea","first_seen":"2026-07-15T07:58:47.662972Z","last_seen":"2026-07-22T09:58:55.730809Z","times_seen":3,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/cricket-x-685907c211c66513097317-685d5206a53cb457022741_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.380Z","timestamp":1784714305380,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/cricket-x-685907c211c66513097317-685d5206a53cb457022741_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:56 GMT\r\nx-rgw-object-type: Normal\r\netag: \"2a6030579f11e8a2acd2310ab38f0e0b\"\r\nx-amz-request-id: tx000009a19c18039791a41-006a6093a4-2d6ec76c-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sdB1Q7oAJ%2B2uNuDlw2RzEEcuADSxGsmtgEOZXkv3xMqAF8zNAQE8QimYh9%2FJoJrF%2F6dX7n6euwjhYUw0MYVgZ9YZ5%2F%2Bi74stSnHKNtI1JvDEgBhGQL%2BOCUosg0Z2z2A%3D\"}]}\r\ncf-ray: a1f196389c335a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7162\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7162,"size_decoded":8121,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2a6030579f11e8a2acd2310ab38f0e0b","sha1":"3608ccd4cd92b86e706ed79e62c1560e77ca051c","sha256":"e1d061e0684135c2070694508475cbf3dd60e349a3ea901d47a667c754117c07","sha512":"8b6bcfb5e7060f60181aa39d0d7e46a65690739fe28ef9d6f13e6793443dcd19676f9d227a5254121d779eb08e3537f6e2452c9d994d442e88157c48537328fb","ssdeep":"192:FWOaj6MR7ZJ86h98z5iS9IVEIw9V8RUinv1:FWO29x/86L8V8VEIwfw/v1","tlshash":"47e1ae120feba845a693e780d13419fb15c9fd8a6c59f74b0288a5b252b906dc38b2d0","first_seen":"2026-07-15T07:58:47.609288Z","last_seen":"2026-07-22T09:58:55.731498Z","times_seen":3,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/35395-sweet-bonanza-1000-game-686d2f74e839f979060599_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.389Z","timestamp":1784714305389,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/35395-sweet-bonanza-1000-game-686d2f74e839f979060599_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:35:37 GMT\r\nx-rgw-object-type: Normal\r\netag: \"f831c9fb9ee94cf0750604be59bc21e3\"\r\nx-amz-request-id: tx00000e8f00d5f2c3f3b87-006a6093a4-2d70c80e-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=K4MI9Q0DnbV3ZcJoQAAAi%2B4JOPi2T9kFDyy7uit3YyafwLec9vDtTK2zrue%2Fjk%2BaJqMdZRrAUA83Db9cVy5v0t1EGjUM3iCrXil3qpdmty0Jot4hkHN7DV3AhaCB%2F5o%3D\"}]}\r\ncf-ray: a1f19638ac385a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 13178\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13178,"size_decoded":14134,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f831c9fb9ee94cf0750604be59bc21e3","sha1":"5a867ce259bf90736b6e5d60e07c40129ece8d8f","sha256":"df973bc6b39501dc37861b46c9fe450842584db556e336d38e816ceea3d6c5b9","sha512":"7d7ac2512a2bd59d031941783eae1346bc6947c33049e7512753bc0e0ce80bddffa1b0cf49d8d1f2a8d5cb4a410ef2c8435ca41232142e44c1b319982714f73b","ssdeep":"192:2GGbefsfJMsY2UyQ2YCdpfupU6CakKc8UT8lwHUXtBuJ07B+cjC3Q+Vs1yvDL:DOusY2Us/dQAakKXvRXrkQ+82/","tlshash":"a942d0c70e7e1d77284aedddb1351ff8438ba0fa5665c1a03e99ac03a34b03d67a0290","first_seen":"2026-07-22T09:56:21.366052Z","last_seen":"2026-07-22T09:58:55.732247Z","times_seen":2,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/french-roulette-classic-68596a3022e5e321251459_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.424Z","timestamp":1784714305424,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/french-roulette-classic-68596a3022e5e321251459_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:41:52 GMT\r\nx-rgw-object-type: Normal\r\netag: \"041fa54c1191051c65cdfeafd8d1d8a5\"\r\nx-amz-request-id: tx00000e9d48364d6ae2a88-006a6093a4-2d70c54d-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2Qqsy3oHu1p%2FuwJfKr7WXkrOgrF9wAsKQ3K1Nwv5XA7o%2B09Bs7gPpx%2FQLFW6A10XP0%2FAbP4VMZZ4QH5FoC9JcRWHjdpEbuHw1DWB6SnoflYaAdG5A7KQASFPpTysLL0%3D\"}]}\r\ncf-ray: a1f19638ec4f5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8254\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8254,"size_decoded":9209,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"041fa54c1191051c65cdfeafd8d1d8a5","sha1":"06cb77390c17cfbd37e2dfb730a4412c3c95dbf6","sha256":"f4c2837fbf9ded6490b64d5b3e705702c1409d8036048c8137cf9abccece2831","sha512":"36652235e302f531f716d218d0c07f3984d7a5625b8e41ae9cd926a50e48f6a258da27b894c94be156bd896fe6c7a31e7df4f226683b02563fbf2d6b48205e1d","ssdeep":"192:uaMc8h8xT/JNZCmofE1EQyRbgJj2gSH36inGJ3ds:uaF9nZFoQyi3SqaGrs","tlshash":"61029f276b31e298095d38414184e3b560596ef55dc4abcfc91ce5d3a33e6a0303e3aa","first_seen":"2026-06-10T04:30:14.146922Z","last_seen":"2026-07-22T09:58:55.732926Z","times_seen":3,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/f777-fighter-685909c6a63ce104103100-685d53a1da0c9256882435_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.387Z","timestamp":1784714305387,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/f777-fighter-685909c6a63ce104103100-685d53a1da0c9256882435_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:39:02 GMT\r\nx-rgw-object-type: Normal\r\netag: \"9c1c8ea2dc5a0d40120c480dce11ec02\"\r\nx-amz-request-id: tx000009e04696a6f3a65e9-006a6093a4-2d78b890-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7KcewFm%2F%2FbASK4YdbbsuhpAtv5k6Kp3n82wooFRrVsuz9Oqp4t7G8GFpCIE%2F9xPcXngZK%2FQTchr4xm31jbUheDMtymkOBau9%2BiP1e9RJA%2FxwdYiCiMMMCszbQeRrZKk%3D\"}]}\r\ncf-ray: a1f19638ac375a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7662\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7662,"size_decoded":8621,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9c1c8ea2dc5a0d40120c480dce11ec02","sha1":"41c59b03a4e28d7e6771ac1deb2465df44947f19","sha256":"53b5b7430f4e69608a69fda9453ca104caee53294655c8aa1c0b117e83c3fe7c","sha512":"e48274f2b1aef32b77a5ef65187f650c4001f6327099b3c757e75eb73ff6c3bc084d514f052daea78142e6ca02cf9e7f41c6f18f365fab7a96e7b07d9dc1ac3c","ssdeep":"96:vDUVnUXsax13NJ92GgSFunaYIIDtUyoXU99MTRGmvRT5KxJHSA9knkcb6pzSqjJq:venq13NJ8GiOID9g9RtUbokcb6JjJQ2A","tlshash":"41f18d4db91898528c2ecfff553b9602f095f8f5c46e588ddae2db88dc1d4349a13a42","first_seen":"2026-07-15T07:58:47.528936Z","last_seen":"2026-07-22T09:58:55.733477Z","times_seen":3,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/big-bass-splash-67fd2866e23e8501641659.svg","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.044Z","timestamp":1784714305044,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/big-bass-splash-67fd2866e23e8501641659.svg HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/svg+xml\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UwTW%2FhKQCFLhLa3vOl1CCDP0KZj4xLlY%2BKSHpk88nMQ74MlCtYiDl7gRwK6olRVVavR%2FGw%2Fc33c7hfMLHLKLZBmNKAsYTLljPrRjvbJBH6NLf81qKCO1E3U%2Bt3YwVB8%3D\"}]}\r\nserver: cloudflare\r\nlast-modified: Mon, 14 Apr 2025 15:23:19 GMT\r\nx-rgw-object-type: Normal\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-amz-request-id: tx00000870e38f9d1467ab1-006a6093a4-2d70c52a-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\netag: W/\"2cf72347dff6c0bd444433ea662a87e2\"\r\ncontent-encoding: zstd\r\npriority: u=5,i\r\ncf-ray: a1f196368bb85a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":202375,"size_decoded":152219,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2cf72347dff6c0bd444433ea662a87e2","sha1":"418db32cb618d3df11394fc91826bbe8cee6de1a","sha256":"7ce4cbdf8b43d1f1ffa19369427b58a984c93a88afbee7ea0ef7a21aba000a0e","sha512":"57b5293baf54b78ab0fd3912d0cad7001e88812c9317df7430104fe3d62f3a7ff7cf9ea7836bc177304b3272ea2b2c22892bf7af5efdf9cbce8fe40aa85fd7fb","ssdeep":"6144:zog+mnhqWu0U1WZicVi1S/Mybo31qv+J9nSz:zz+4hBW1WZiJ1TxUZz","tlshash":"0d1412741c814e2e07e616a473dbde5b5faa599fb680585de2c43cc3849899f0fba0cc","first_seen":"2024-05-03T22:08:28Z","last_seen":"2026-07-22T09:58:55.734094Z","times_seen":94,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/fruit-towers-68590f6c7ab3d841795109-685d536ac3a11076267756_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.360Z","timestamp":1784714305360,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/fruit-towers-68590f6c7ab3d841795109-685d536ac3a11076267756_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:39:05 GMT\r\nx-rgw-object-type: Normal\r\netag: \"ee1adb1cbfaa50b2fbb30052f193466b\"\r\nx-amz-request-id: tx000004044c9b04718a564-006a6093a4-2d6ec776-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Fou7JqU9TRiQGGra12O2LBytxnXlpQItOj%2FKIu%2BcZPGguvkqtXuJTxuftWF%2FqDivDHs%2FOGid0k07qmgdAA4ctkcYQBed3DFL8jj6tx2VlDZ3dUkLdf3XqqWFOdt41yg%3D\"}]}\r\ncf-ray: a1f196387c2b5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6972\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6972,"size_decoded":7927,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ee1adb1cbfaa50b2fbb30052f193466b","sha1":"d2f70210991f730166771c4e0bfe3924e97789a6","sha256":"268280a6be38d54bf0140dd5c73aa02ef00f8893f9044521f1ca9d0b90edd3a3","sha512":"81f82d80069e451051b1d8a592005ec1a4cea2731d302014ac6a8a4a0c3f9cfa0c860c55acd61e2967a970292c91be96a70f4ed91837af25ae36c4d9af8a0157","ssdeep":"192:9KTNFstUrpDGH2e+giNm8yaKXv5OB8rKEA+s2/lkO+O:9sNFsecHogiNmEhB8Aj2/AO","tlshash":"49e1af76cb6d884acb407dd36dcd2f9b41104e9ccd826774b71f899a8d3c912126be1c","first_seen":"2026-07-05T04:13:24.9224Z","last_seen":"2026-07-22T09:58:55.734609Z","times_seen":4,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/first-person-blackjack-685961acc2525049149028_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.422Z","timestamp":1784714305422,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/first-person-blackjack-685961acc2525049149028_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:41:15 GMT\r\nx-rgw-object-type: Normal\r\netag: \"96d296d103ed6086d8dcbc30bbaf7543\"\r\nx-amz-request-id: tx00000a3e1b80ee07154fa-006a6093a4-2d70dda8-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=m8PW4mgNQXjFXvTYG6ToqnLZzF90hnH0Df8nBO8hFiC2k9TDC0ygbvTwgtL0b2TB%2FeH1y0uj7dtcz9M6mOoHyh1EycEvaZMpCOcshkfXrx%2BQ5b5f2McD0JQjpUuiIfc%3D\"}]}\r\ncf-ray: a1f19638dc4d5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5756\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5756,"size_decoded":6707,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"96d296d103ed6086d8dcbc30bbaf7543","sha1":"fd153f0480e0092e5d082087071eb2280f492545","sha256":"32811c6c0918061bb64b1df24b7b0f80b04d0490521dc318f75005faea587993","sha512":"559d10e6623b03ef8b1e683f0a765102a2bccb617fa01357777bc86eaa8e8ac3d32d4e8a2569020ccbc7c8f1388001b49b6f6c67c043db047a56fdf52abb5c26","ssdeep":"96:+dXZX0IoVeJrCrpWrgzqmAvzM8xUrCyvn8ExbLo4/yu5DDcWDoqp:8XZX0IYfrpH0rbGrPn8EX/yu5fcJo","tlshash":"c4c17ed0daaf00559c5ce230da8939dc30c2b7cb11a4895d016dccdf438c8d43a586fd","first_seen":"2026-07-17T01:07:08.943393Z","last_seen":"2026-07-22T09:58:55.735119Z","times_seen":3,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/rainbet-logo-696e739d435b1865325084_457x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.017Z","timestamp":1784714305017,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/rainbet-logo-696e739d435b1865325084_457x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Mon, 19 Jan 2026 18:10:39 GMT\r\nx-rgw-object-type: Normal\r\netag: \"ca265593ece4163274471e4635ae92b6\"\r\nx-amz-request-id: tx000000e0921c9baee30ca-006a6093a4-2d7890f4-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7%2B4WF%2Fnekr6Kbk2OBrhbJeZraLG9WKzdWMluUkVPhSXb62o7vSVXd0IwLpbt7GTA78fXcMCzghf%2BgG2wm0heLZQgM4mVnBizaLPfyj%2BUIlkT%2B8nJmZ5H5JDk0u35S9E%3D\"}]}\r\ncf-ray: a1f196365bb55a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7426\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":7426,"size_decoded":8383,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ca265593ece4163274471e4635ae92b6","sha1":"7aeb376433047aa1a3cc6421f22f951eec93460d","sha256":"8b52e4c93edd6b6761639e7217bb66025ce018ce1f2b2f73a9e6931277629eef","sha512":"f75e750b03a3664336096abbf14c869025938d470183665548785440cfc672609f2ea83ada18d256f7021fe267f86ebb9d32eb815e7e248a3be5b758688533b6","ssdeep":"192:RnVUEt182DjZXSKcrwUk5H3ZFaRQDpNnSPuYD:fUIO2D/crwUoXeRgnS7D","tlshash":"bbe1afd721c8d4b2b2495c6df8e50f2ef1c4bce84c8ade772529841189b7c60e36b252","first_seen":"2026-07-15T07:58:47.83243Z","last_seen":"2026-07-22T10:07:05.808052Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/favicon-rainbet-696e73a68e392311559144.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.268Z","timestamp":1784714305268,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/favicon-rainbet-696e73a68e392311559144.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Mon, 19 Jan 2026 18:10:46 GMT\r\nx-rgw-object-type: Normal\r\netag: \"16a2a18afdd98e09cf6c56d272de4318\"\r\nx-amz-request-id: tx0000062ddbe670c896c6d-006a6093a4-2d788d61-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wQluZNohslLHTandovPUuC1QjKSsFa3NiiYEaN1NrEbobmL1Og61X3SsbdolDT4WVGz1kKTt47cp4B8lEwj%2BiAKK0jmLd%2FNx6HyltKzxvzzJxGPGDIBhaDaUrDy724Q%3D\"}]}\r\ncf-ray: a1f19637ec0e5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11086\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11086,"size_decoded":12041,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"16a2a18afdd98e09cf6c56d272de4318","sha1":"044f3b36acc71b547934b998331319605bbd1e04","sha256":"604694e170f85e28737886427cbae4d5b3d4a8eebdc8daedd1c2ce60b5d07717","sha512":"0ba7fc83fff5797e7ab68263cf67f718c14ecf8e08db0037220db58c6acb8b67a78b74459f3f7b28739887d40055c23c340953d901b4c59bc620f32f98f0feef","ssdeep":"192:FDHd8AFZQJ00ebN/jlqfRiTSJImYhbnC/HuwNqKHZYRS1+hvb25FV/tVoJfTwOL7:v8AoJdepjlqfRiLxRnC/HxUKKRSA1q56","tlshash":"c232c038a28d758630ce19509376cd30904ca84bd79d3cdb862c69af4c4866eba7bd16","first_seen":"2026-07-15T07:58:47.573374Z","last_seen":"2026-07-22T10:07:05.804448Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/caribbean-stud-poker-686b72e24e0f2159351008_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.346Z","timestamp":1784714305346,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/caribbean-stud-poker-686b72e24e0f2159351008_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:35:59 GMT\r\nx-rgw-object-type: Normal\r\netag: \"7c74ce5334b37a71ae8683429f7e8dfc\"\r\nx-amz-request-id: tx00000ff210fdcaab084b7-006a6093a4-2d6ec908-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3nChe7uQ83Do5yqIJk4Ptg49d50JzAOc%2F1aW%2FEEdZOMjmdMt4ahyCGdx2aG9y7ztitWGzByqao1D23cN92NgQNJDUTeYsPGgK6PR5noQyj4pFRXUKDsbU28Bu8%2F8IvE%3D\"}]}\r\ncf-ray: a1f196386c265a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11064\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11064,"size_decoded":12018,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7c74ce5334b37a71ae8683429f7e8dfc","sha1":"1e12de798ef3067d12e25907445e57811e4e0e5d","sha256":"b94f876283d8479000ed64591e5fc45a7ba45a23e2a5270b0536f2548858dd6b","sha512":"f4682364bdaeee622dd76727ba0460f70f2252f4e41385a3730599e5dd3886442c88da80b58df7baf259826f4d54f7efc9c872628ab57844bde81d3555dd0b49","ssdeep":"192:+lSj89Rq5t515EXbwBRl9oN+sDpEF7zrBNqaYPJHLsQulIizdiJ31+cymUDFQD/F:khRq5DnEXsBRl9o5pEF7nBNzYdsuikqE","tlshash":"3a32bf13c744a54717aabcb6fbaa99bd82d306eb28172c7f12704fe336a460c15f4914","first_seen":"2026-06-10T04:30:14.158901Z","last_seen":"2026-07-22T09:58:55.736969Z","times_seen":5,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/marble-knockout-68596ab7bfb19144574107_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.435Z","timestamp":1784714305435,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/marble-knockout-68596ab7bfb19144574107_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:42:02 GMT\r\nx-rgw-object-type: Normal\r\netag: \"c6a5e326664752802d899f8c9237d376\"\r\nx-amz-request-id: tx000009d8f1898c4f5d462-006a6093a4-2d6ecd34-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tL7gV1xeU1GNRXOhhFyjCEcbRCNfGcuFvqHs0x%2FwBNV3hsF9PW5EhbP7soZ82daUfiFHoJPqhSe%2BXkIx7XGmTW202EKo%2F6u15c50eSkZyMOVXBuyeY1Cvp3tPxfbcMk%3D\"}]}\r\ncf-ray: a1f19638fc595a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8468\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":8468,"size_decoded":9421,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c6a5e326664752802d899f8c9237d376","sha1":"1c7cffd738008e32a8bf93028505691cfa053094","sha256":"f9ff996384151787f02d1acd7d08551063ad47935e2feba76019369020f56ef2","sha512":"e05a00afc03a7f2eb6e3209ad1aad71d9fac8c5195ffb185db851cd5c20874ac84c8ba8c70b3d848120959bceff8f4e0bcaf06156080f076bce62bb2d1d3ba33","ssdeep":"192:/bBmUxYvcxPdxOxnX4Spgl1VdTUuBp3P4xQjhOETtYnry0ds:NLxtx1xynXvIpUap3kuh7YO0e","tlshash":"3502902add37b740c69b705ba8144f5286a1c9eec4d4bd0c1a71145d4d138d7b12f7ea","first_seen":"2026-06-10T04:30:14.147742Z","last_seen":"2026-07-22T09:58:55.73758Z","times_seen":3,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/assets/fonts/inter/Inter-Bold-64a1a969c6d497188ec2db849572b34e.woff2","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.015Z","timestamp":1784714305015,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /assets/fonts/inter/Inter-Bold-64a1a969c6d497188ec2db849572b34e.woff2 HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rain-bet.xyz/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: font/woff2\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 16 Jul 2026 10:28:13 GMT\r\netag: \"6a58b23d-1c098\"\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: blob: https:; font-src 'self' data: https:; connect-src 'self' https: wss:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:;\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), fullscreen=(self)\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nage: 156\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=owlrTNaiHFHTdvJ%2FPbekGXMp5gXp5CnGcK4KbuEv48RtwYSIiwAXMGRMBz0VluqUvSlcULx9IPrS1BUcg3CUHi3Uw6MJyDicnRfhyDOAauXiHWruhrdpJbC3VpsKUhg%3D\"}]}\r\ncf-ray: a1f196365bb45a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 114840\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":114840,"size_decoded":116103,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 114840, version 4.66","md5":"66894432e7ff485b0d4810f6aa95573f","sha1":"5cbf10e9f8be7dac2a365bfb21fe6ddf4641e569","sha256":"fa888127b6da015b65569f0351f3b5c391ad928904951f1c20e9f8462a8d95ea","sha512":"0768f605341013a3c21aadb4f80eed3a81c0502fa79766eac6dd83ad6b7b135b24282deaa07419b4f29e7f45d96796976e07f0dafcbae3e5cf6421afa7e5c209","ssdeep":"1536:7JT4B6gU0SWJAbfNw66wMA6ImioyFi9MB4vIkuv4uVdbT5Dmi7uh6XK910:7tcSlbfNwgm3r9MiSJb+hZ6","tlshash":"3cb312142fca602de66bf32c2bf3e20385357964e0475e41f2948bab111b4bc3f4d916","first_seen":"2024-11-20T03:00:23.656898Z","last_seen":"2026-07-23T07:19:15.975402Z","times_seen":6248,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/jetx-6859122944935845204417-685d56c3aab57964649910_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.352Z","timestamp":1784714305352,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/jetx-6859122944935845204417-685d56c3aab57964649910_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:39:26 GMT\r\nx-rgw-object-type: Normal\r\netag: \"75f48aca8461d42beb6b398d475248ce\"\r\nx-amz-request-id: tx000007f65ef627cf864e4-006a6093a4-2d6ecf61-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ouvqZq77tGeNBT%2BAP%2FZpTi2trY%2BZ8jn2pthqwBXU3L5p3zHmKLtwPrHRa9cPv7AWg6ev20%2BtccKpwYDaMS5CWxrZSl274IvNcOTer6HiNH06Nu74D9Axep50B2A9bqU%3D\"}]}\r\ncf-ray: a1f196386c285a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4230\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":4230,"size_decoded":5185,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"75f48aca8461d42beb6b398d475248ce","sha1":"c9e79f6a09f47eaa1281a6baf015f6930ba38635","sha256":"617e8f983e9d92b61583c8342d3fad900c8ee7898cd947c9bfbd0613748376be","sha512":"e7d51d032a178756c8193aea08125f3d0e75796d7557cb79cc8d0d324d7f8df52bf98cdb1e550fba286e09328a431da77c5ac945abfaa98fc40c6ecfb8559906","ssdeep":"96:GDsJ6QjaAszgMC0kzGmuWIz4fnCIf5erFSeLYXWO9:GDs4hFz2Tzl4zKf50pLYmO9","tlshash":"13917f12cd4dacb8224c07132e611f27e2cac3b24fd51bfb28e575268da81922f96d34","first_seen":"2026-07-05T04:13:25.003163Z","last_seen":"2026-07-22T09:58:55.738656Z","times_seen":4,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/1tap-mines-685905ea0de35815566726_156x113.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.364Z","timestamp":1784714305364,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/1tap-mines-685905ea0de35815566726_156x113.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:48 GMT\r\nx-rgw-object-type: Normal\r\netag: \"37159d1b606bb16ee05d354eef877f3c\"\r\nx-amz-request-id: tx000002dc475fd432b445f-006a6093a4-2d70ec2b-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MiNH85p%2Fq%2FhlryQYGpBVIVUodMBFqVjcNchYU07wq6n7cKntFZ27U3GY91oDGXzLEjb1uMWFNqgGL0DkgTTWE5gOe9iHlLdH2lqpMQbUTTXVY42Je1xanOBrd0IQI9g%3D\"}]}\r\ncf-ray: a1f196388c2d5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4948\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":4948,"size_decoded":5899,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x113, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"37159d1b606bb16ee05d354eef877f3c","sha1":"c962ec0a45046700db1290901ee4bed72df6daf2","sha256":"be67654beb17a366175de173640fee889ded33e0eb4e0f03c33b7b199c475e1e","sha512":"39fae1eee7705838d90693b79aaee2a9d088346328cfa519406aa1fc1c74476b035eee04a87542c3a0524055daa6edde8358e98c7bcf90ca114af1df1c9c6e7a","ssdeep":"96:0RCnl83X4mBo01f7y1q3u/OMfM3+cEbn8W2qUSgd6j7JO:0gl6Dtn2M3ve8W2SgAJO","tlshash":"1aa1af8ac322b214d9bc223842f7d1a1ca6e4f21b5753f47b047d3650f705af226d086","first_seen":"2026-07-22T09:56:21.363101Z","last_seen":"2026-07-22T09:58:55.739297Z","times_seen":2,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.079Z","timestamp":1784714305079,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript\r\nexpires: Fri, 24 Jul 2026 09:58:25 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dpe1uirTWZSq69Dx9t35tAWYskwjz%2FlfB7SqAjWKahQSzSS8k3%2FqR2BXQMWteuuItFk9RG0o%2F8auLbcYdo0CsjIhuL9xT01Kbt6ZEHuLtj39RyohKOV9azc3vAw6eAA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\nserver: cloudflare\r\ncf-ray: a1f19636bbc05a0f-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":1286,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-23T11:25:05.719537Z","times_seen":404310,"resource_available":true,"data":null}},"time_used":3,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":3,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/angry-elf-christmas-miner-6859063368482499730865-685d51860bbcd815858871_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.368Z","timestamp":1784714305368,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/angry-elf-christmas-miner-6859063368482499730865-685d51860bbcd815858871_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:51 GMT\r\nx-rgw-object-type: Normal\r\netag: \"7246e948fec4c527aeb986a2b676ddf4\"\r\nx-amz-request-id: tx0000026320c6d26d408fb-006a6093a4-2d6ec776-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5aWlj9WYsVHTFnnmCxb70ZsrdiZroTM6%2BC6DZYBTWKDXveLYdBaGGplxz4ShLiKGrryBXQlszxmiXxszLMc7O3ibFgS%2FfY8%2Fsa4aoLPMB0Rr6JC0gfPRzXvxkDmgq5w%3D\"}]}\r\ncf-ray: a1f196388c2e5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9264\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9264,"size_decoded":10217,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7246e948fec4c527aeb986a2b676ddf4","sha1":"bacc33f131a73cc1f862faf758d53f66c3e62083","sha256":"21bdcd879345cbdf22f0f8acb71397b3974b8d59ea39ea36fad20cae3a47a978","sha512":"220688f87b033cdb15faba4266c6ecd43508bc585ead97da5c42b09a1eb296ba3f281b60289566e92e98a3d437a752b96af80cec7f8ee94f01e052ce2c31217a","ssdeep":"192:AA8xLZ7CRNQLI0ZNIHebAdg9CXeFNJt6r:reL9CLSIoNeebAWNFNJ0r","tlshash":"2512af66814db08aec01a22e43bb08d7691cf9337917f1f449afd853db92d26b125b4b","first_seen":"2026-07-15T07:58:47.775812Z","last_seen":"2026-07-22T09:58:55.741816Z","times_seen":3,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/great-golden-lion-685551854b969789694370_208x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.394Z","timestamp":1784714305394,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/great-golden-lion-685551854b969789694370_208x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:37:25 GMT\r\nx-rgw-object-type: Normal\r\netag: \"88667fb27dfd9d800a513090483c4e0c\"\r\nx-amz-request-id: tx000007247dca4ceaff429-006a6093a4-2d788d61-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vuHpw7vTHUJsGHh%2FZU9NduYRQ6zu91%2Bf%2BNONMw8QIPNxzheprzOv%2Bd09gn%2BM%2FeuuEeF7eZmNw9Ans3PpTFQ8%2FdGpmt09Eaidypi44WpCBrI9yEmyRcUa2pPuVIjU7UQ%3D\"}]}\r\ncf-ray: a1f19638ac3a5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12782\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12782,"size_decoded":13744,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 208x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"88667fb27dfd9d800a513090483c4e0c","sha1":"faa8b9c4eac1305dfec02e8bbaa854a6ac5ebea5","sha256":"6bc8bfae7d683f85bbcdd216b6a7d9b08b67dfed8e632665144726870cec1ab9","sha512":"48656842c2aceada3bfcd798702fbe3e0559b5bcb340f753f5267c5a4f2b651e13d3e4e8793d7c1fc03f23db2795c27ef1b0ec20c455e6f7a513976509d894c1","ssdeep":"384:EtsmEl2w5KIFuVaD9Hprz+M8skMwzHWajIqQqVN41i:EhSJ5KfcDrqz7HWoIqt+1i","tlshash":"c342bfe9437de82c790fd88935f523a1dcdf429180f4ba7b461d8122cb5c90c1dba89b","first_seen":"2026-06-10T04:30:14.159726Z","last_seen":"2026-07-22T09:58:55.742505Z","times_seen":5,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/buffalo-king-megaways-686d26340ec6f060939946_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.405Z","timestamp":1784714305405,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/buffalo-king-megaways-686d26340ec6f060939946_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:36:56 GMT\r\nx-rgw-object-type: Normal\r\netag: \"ccf64e1f8d05eed1b547307a7fec33d0\"\r\nx-amz-request-id: tx00000788bd95fe8aab9a4-006a6093a4-2d6ee27e-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BDcd5JxLoC6IeOOu2N6DTfyXkeOTb%2Bl3mIpyWft9jMk%2FCXu7EVhuigb38c%2FLIBmux88PJyjA17K7mSDej5G%2FdjWhBRKI3tu81RAg2mjME56YquQMcvogQ1TaLYHkLHU%3D\"}]}\r\ncf-ray: a1f19638cc425a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9908\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9908,"size_decoded":10865,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ccf64e1f8d05eed1b547307a7fec33d0","sha1":"a1208b95022b4422e1f8b61e481f92400090f467","sha256":"e4636f0ec49839eb413533746e68610a32d4dafee730002aa48d2c5bebcc3619","sha512":"aa06c73cae97dcc11987489a24b3687de6cf370a65050c30c22a9d239a72ea8d8eed2ddb2661d8cc60a3f4be373a481ddfef85ef2eb2d2ec20f9732e613b74c9","ssdeep":"192:6m+ZRfDBvPSYhA/OJczjO+fWjO0klU/yO+qmlS9iZKfECy7u8VT:jIZ4NO+fW4lwy8rfZyaw","tlshash":"a112bf518bdfe7f62dbb74be7cf60f7e247cab463154a07068890da84b98056b721207","first_seen":"2026-07-05T04:13:24.954949Z","last_seen":"2026-07-22T09:58:55.743119Z","times_seen":4,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/kingmaker-pok-deng-68596a84c2283921843816_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.431Z","timestamp":1784714305431,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/kingmaker-pok-deng-68596a84c2283921843816_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:41:59 GMT\r\nx-rgw-object-type: Normal\r\netag: \"16e34f702a0a1e32b310491cab83817e\"\r\nx-amz-request-id: tx00000d43cc147f07b2100-006a6093a4-2d6ecd2a-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qaIGTkWkj7jSsJ0Juck8hFMiDt0TRX%2F%2FYW21vs1mBgkrSIfoMjfdXUjOohQNB8ibop3uLlyLzQu3Gdfq3ZMEToUsy2bLuFkT2n60jlThVTKR1MZJuGXX8gOd2%2Fm0dZU%3D\"}]}\r\ncf-ray: a1f19638ec555a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8962\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8962,"size_decoded":9915,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"16e34f702a0a1e32b310491cab83817e","sha1":"9afbe1d1a89d7231a3f317f33de77acc568a1882","sha256":"484be02670117afc20c7d0fe0a7eca99d72ddc5ec43765492b9fdf7c390c1507","sha512":"fd494ca5d04d0c87931b47897900b37db5940d56650425d37a328df396f6be3d67371f63b662c7607ef490c1452c193bdd6cc3a0fb50fd3f78a042936c21e13e","ssdeep":"192:UoUIAMgsF0j5UdK4KahYNzhTJUbkgogTJIGGiV+kAU9YcwceAc:UoUEej6saafm/NT+hw+kAU9JeAc","tlshash":"9c02bf870ac2fe34252880b8d0f6cb6da33064d54cbd87ec5e6c49518a0a634b3769b3","first_seen":"2026-07-22T09:56:21.372696Z","last_seen":"2026-07-22T09:58:55.74393Z","times_seen":2,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/bac-bo-6855083fdbb93952036809_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.332Z","timestamp":1784714305332,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/bac-bo-6855083fdbb93952036809_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:35:55 GMT\r\nx-rgw-object-type: Normal\r\netag: \"f00da37e7f31dafbb5682c1da2e82de6\"\r\nx-amz-request-id: tx00000cdadcfe0e5a19d80-006a6093a4-2d788d34-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YrDoQqtkeMi1SBHT7rr9%2BkOPYBohCjwjXSt1oMDZSZA9BU4auElkbZFoWjG52XZmzZLMReuHzEyQHuEQaduWPYGZqsJ%2Fx1j07K7NEB3IvyOwpchJjCzVrb2N3Dtw8DU%3D\"}]}\r\ncf-ray: a1f196384c215a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4944\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4944,"size_decoded":5895,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f00da37e7f31dafbb5682c1da2e82de6","sha1":"90c04e38891e3645c86108ac302a247c3039bb9e","sha256":"eb74720c163c57bbdbd6c189ad28964e67c3410ae2eca66835351cddf9880be6","sha512":"5879eda0874d1b640d58932cca5a1321becdbe0cecb3e923ca4f406c247e4184721c3926611581f30cf73ab8ae07425365bcd4c2fa561e6912643e1290365266","ssdeep":"96:BkeAWdwoqKyoBbpbU/eLuql6uwQCW3h7Er1CFB3wSE7mhACHcLozJW6U5:Ge71rymZU/eLXcajKxCFVwNmCIXk64","tlshash":"d3a18e1d18aaa62b91620d4dc02343ac9d530db96405eba1805ec6f3f9fdac3c7e45b1","first_seen":"2026-06-10T04:30:14.158044Z","last_seen":"2026-07-22T09:58:55.744696Z","times_seen":5,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/instant-virtual-greyhounds-2-686d23068c578039960905_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.359Z","timestamp":1784714305359,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/instant-virtual-greyhounds-2-686d23068c578039960905_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:39:05 GMT\r\nx-rgw-object-type: Normal\r\netag: \"166991e8b316cfdd34dbd428d721b660\"\r\nx-amz-request-id: tx000001809086e11ed1419-006a6093a4-2d6ef07f-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rtbK7GsAihFOuQRGQ9ZUQwYchDTHwt%2F3UIapSaXE714IBgVRXoA6f4%2BhBDGXR4vuzdrcSRNGAMk58Gkf6i5GH8nssrK1aJwzJazFumgcor1UhGp8V9f1bxTqZTQTz2Q%3D\"}]}\r\ncf-ray: a1f196387c2a5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8724\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8724,"size_decoded":9675,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"166991e8b316cfdd34dbd428d721b660","sha1":"92805f00dff567122af3e0e72459c9881819d1e1","sha256":"b9a4bc6a651caae895313b121e3df75f9907b9c7ecce3c45c7b6523df37209e8","sha512":"c7b27ff9a613ec98e66df1641af7340108c71ba914bb1b09b70c7e8329d25b0879dd10bcc0bdf0c8d949524f3d260c6cc65783189b5eb1fcc8e001de2150c15c","ssdeep":"192:zsRFzuWVkzs63jOYeugtnkvxySk/cvNwJc75EaCiW+u:zsjzvGcYPglcx8/cvNX6ie","tlshash":"3f02aee8b221c560654cf9348949af8d4ff0535a1015beb62bcd3326769ae06723f316","first_seen":"2026-07-22T09:56:21.37655Z","last_seen":"2026-07-22T09:58:55.745274Z","times_seen":2,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/disco-777-68590856b8406440476798-685d52428a68a375814044_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.382Z","timestamp":1784714305382,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/disco-777-68590856b8406440476798-685d52428a68a375814044_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:57 GMT\r\nx-rgw-object-type: Normal\r\netag: \"4018e53986337ef5ffb918083db82bd9\"\r\nx-amz-request-id: tx00000e8c91ec4b4e53336-006a6093a4-2d6ecd2a-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3uJ%2BGREX%2BtYs5scEzj%2FzUQmLTW8GW5lq7z4k5r9lkBlq1pNBdYFBqcUofwgbfU3e3KiETpk0HLVMrvrkTJPsv8%2FTLiBENDLRPfmdXio8YjMBfVmPhewPtU%2B6xunoloE%3D\"}]}\r\ncf-ray: a1f196389c345a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5916\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5916,"size_decoded":6873,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4018e53986337ef5ffb918083db82bd9","sha1":"6d3cbad7321ce04bb0db6b530d76f1fbb4bc6d1a","sha256":"5219d5fa7c5cd8f40c1bab5cf0bb3b90ddd6533ec5d4e4b70afa912cc4541e98","sha512":"917d964ebf881b7cf91f2893659575a4416c86b1779bd65b76fd24e1c9e167388fe2d644d4690d91822611a0af6cfe10b7d8ff59da872b7b92e87cf9c6a7da39","ssdeep":"96:iqOpU4/v3DkTImGuucyIzEBQlSoGCIAb/Tuf8wqEKbiBb1TUFPimTbMUP7416YRM:iqOH3DkRvyIzYygqEKOJw5b7yRa/","tlshash":"c0c1aecccbac038ae6d3e2a302ed2fe66d8595648b50d67351a82e1cf30c253047d8f4","first_seen":"2026-07-05T04:13:24.944442Z","last_seen":"2026-07-22T09:58:55.746212Z","times_seen":4,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/dead-or-alive-saloon-685508a8bb345014046184_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.291Z","timestamp":1784714305291,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/dead-or-alive-saloon-685508a8bb345014046184_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:36:00 GMT\r\nx-rgw-object-type: Normal\r\netag: \"6629e6dd1c3c979a5c0a448b0993fadb\"\r\nx-amz-request-id: tx00000471c0d46e8e87b0f-006a6093a4-2d70c80e-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KJbGkRj7UEMTrZre4QHG9dQ2bpjItjITm5Y6kL0pHAezm%2F9rsi32U4im9sdD3oRwcO7IyEIGgsAKHRT8uW%2BHmvUmvLbVQfgOWXjc%2B%2FNRjKrxdp8DLgh0bN4U0TdEZe0%3D\"}]}\r\ncf-ray: a1f196380c125a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7900\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7900,"size_decoded":8855,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"6629e6dd1c3c979a5c0a448b0993fadb","sha1":"aacf044731c073a80792cee1c843835e6a9bee0f","sha256":"5e677013b2112192826f243c409e199f99a771c62add8a21152e42a3dddaf7ec","sha512":"42b9929b13008dd369a8e2d8b62d242d3b18a87aa5798a4496a6ce8cd2f644339e4db533897233deb2e096f61698629e366bce7e5c2ddc3f62fd633e88bae121","ssdeep":"192:yHbPWXUmwoAzUApTk4wzbyAqPOrex3fUTGr62:UekmNWLTL4ex3fY2","tlshash":"87f1bf2961387b284c8ae13086935e4b17cf043f7294797206ad4f1280be7d310ace96","first_seen":"2026-07-15T07:58:47.656887Z","last_seen":"2026-07-22T09:58:55.74693Z","times_seen":4,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/blackjack-party-68558ac820424275002785_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.318Z","timestamp":1784714305318,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/blackjack-party-68558ac820424275002785_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:21 GMT\r\nx-rgw-object-type: Normal\r\netag: \"c728d1b5e8dc37745460f4613b9e5e49\"\r\nx-amz-request-id: tx000007d4d763cdbe72d67-006a6093a4-2d6eb716-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aBpnnHfkKf6gwdlXxHSctk9CfNXMyMEhsEpuoXRkfTRppdQD11vzkLcuFj3sH395pdze4%2FGO8E16dLQuCQ7wE%2BjG9UsKa3M7M1kXlX1afuU6nMFie%2FNJAmVM5KrmbKc%3D\"}]}\r\ncf-ray: a1f196383c1c5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5742\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5742,"size_decoded":6695,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c728d1b5e8dc37745460f4613b9e5e49","sha1":"7543baf235ec251240612a350380faa07428a781","sha256":"b7ce22016e6fd2534382a2d7f9bddd36c804f73b1c9fbd04146300e10ccf961c","sha512":"83caa0277e961d90ce7d49c947dd7c119334556f070386d43697bd1212f2c74b105285908d403708fb9c1b803c40bc4e94e1c030bcbbd2a991b792188863140c","ssdeep":"96:xyR+3xyAS7YbBcGaejoyh7yvqucDIO3ecRg08VBYPxW/ghE84IJ5lrpMD:xQ48sV7LjvbIO3e8qVoxiK1+","tlshash":"b6c17dc50d2255c8ce002dd8d71f6d0aeea8a240faa4b334eb6225d44a1967637f61ca","first_seen":"2025-12-08T06:56:23.134815Z","last_seen":"2026-07-22T09:58:55.74789Z","times_seen":6,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/lightning-baccarat-686b737e767eb932033182_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.326Z","timestamp":1784714305326,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/lightning-baccarat-686b737e767eb932033182_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:26 GMT\r\nx-rgw-object-type: Normal\r\netag: \"d9d851a4ee7313fe2f8235875967c6cc\"\r\nx-amz-request-id: tx00000d39be0276ec66b76-006a6093a4-2d6ecd34-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bfxZGKTVetUaJwfCvgjph%2B10xKCOtaUYSUnZDN4FIIAP56vMDpPq6Wnf%2BiV9KeWSNknj0U1wJzHmBXqUUTKfLmiHI8Y39ezCYxt8yG68I5pxAaJBANMt%2BwouxPV%2Br0o%3D\"}]}\r\ncf-ray: a1f196384c1f5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7964\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7964,"size_decoded":8919,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d9d851a4ee7313fe2f8235875967c6cc","sha1":"dbcb7efc359c01514432f5d721911e9918d2af50","sha256":"cd3a916dcb08c2b7e9c17438c26cbed61bdd42d2045b212bf86467ae717f18f5","sha512":"247cc556e4a8c52f283c14db643b295e29a82d473868da698b9a94ab30243de445fb96d55c5ee645c6e8c04f7145c7e5e4d77273db0afa4069e74ece70971b7e","ssdeep":"192:zmbgZ8xBty7R0pmQkpTL7dqpUKSLr8uRBnj/sa:ggCBB/kpOUKIrXjUa","tlshash":"10f1ae477f77cd59d88abf626b9eb0702c99c502ad2676e298c71088956087e7f01087","first_seen":"2026-06-10T04:30:14.169436Z","last_seen":"2026-07-22T09:58:55.748583Z","times_seen":5,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/double-roll-6859086da41df925807219_156x113.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.384Z","timestamp":1784714305384,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/double-roll-6859086da41df925807219_156x113.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:58 GMT\r\nx-rgw-object-type: Normal\r\netag: \"9cb5700cf1362bf474c20f5de2b42776\"\r\nx-amz-request-id: tx000000067bb0e32b47e1c-006a6093a4-2d6ecd2a-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8J%2BrBuUbqCMNB9t1XVRK217pzNld1KFT7tde%2FIzCILJTwqaOjpwMc8ryyNNXyYPos4LswBepjYmdFmpLgex%2Fx%2B0Qcn%2B5CU10tWfcRuabXC1RwpeD5JzdFC%2BvtpQJl%2FY%3D\"}]}\r\ncf-ray: a1f19638ac355a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4362\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4362,"size_decoded":5323,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x113, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9cb5700cf1362bf474c20f5de2b42776","sha1":"a5d94a31abfe795084517bf48f47ca86a7c3fc0a","sha256":"829d9610e2a9c0668d8271a544ca8f7371b6b1c9c6819c68c10e5f7914205f39","sha512":"e9f72be97db52e70f17bf6a6a9d10dd276395d42cbf0cde4d271df8c29dadb50032e1f7bcb3e12f5c06846a10481bb02ad22a6dd940d7af05c0ce75d37f25a9e","ssdeep":"96:rmT1bfdviS4DzOMqEtighqDFJPLhQbjxKG+uPoQMfJI:rcvTghMJtQHGfC","tlshash":"d7917d949b0266e5230143589eaf196c0ee9d18272d31ca73bdd4947eb3c6785e0e70f","first_seen":"2026-07-19T02:12:37.9026Z","last_seen":"2026-07-22T09:58:55.749256Z","times_seen":3,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/fruit-party-2-6854fecd98b5e643186012_234x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.401Z","timestamp":1784714305401,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/fruit-party-2-6854fecd98b5e643186012_234x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:34:55 GMT\r\nx-rgw-object-type: Normal\r\netag: \"435abf1a38bde78d142748d60459a927\"\r\nx-amz-request-id: tx0000008e8e926c2a2636a-006a6093a4-2d6ef3b3-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EApCqSsT60m6gHTfslBzDzXQhW1jzwU0L39hqFhlolQsPwI9%2FxsszgMKO3yW0oG8%2FYtO2zAXZtaqnO%2FgRta6Y8UvXNHzwPc3665exsrhUdtfpQqLoWOXb39CJv6XW8A%3D\"}]}\r\ncf-ray: a1f19638bc405a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 15130\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15130,"size_decoded":16084,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 234x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"435abf1a38bde78d142748d60459a927","sha1":"cdabe1bffbdbac2f86d5175773b1c0ece86c0e5a","sha256":"a60df8167cafb4a60dac261f30511d17327a444076875c9ad8c6d6f15f41b860","sha512":"1be9f9d487b0f23319ac617ac120c06454f258a8fff41343020760b3ea48c8eb72764b277369b74a015f53c7789b98782b303ec294d8c39f78be872ad4e7001d","ssdeep":"384:mNYaZoleCyHUqI+Yo7gKGTvmbllHOiGCjvAUVc93n0P+:m7+1U7g3ebrl3jvshp","tlshash":"8462c04f7b0fb0ab575d1113247323b00669bedd72e386089a4e6a40a15fad4b01f7fa","first_seen":"2026-07-05T04:13:24.972809Z","last_seen":"2026-07-22T09:58:55.750005Z","times_seen":5,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/rise-of-olympus-100-685500920b158582024010_182x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.404Z","timestamp":1784714305404,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/rise-of-olympus-100-685500920b158582024010_182x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:35:26 GMT\r\nx-rgw-object-type: Normal\r\netag: \"8a01a9c05d67616ac4155d65a01708a8\"\r\nx-amz-request-id: tx00000e15dadad94f7b5f4-006a6093a4-2d6ecd34-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sBdQYjzerAXLFn6Ml5Zuic5e68iHSAVbsYYe45wx112zhGjr8G%2F4%2FLO5CqORgrE%2Fr0tXe6w9VJdvyU5AVfpYZEZR48XJ4JpgMxWVWMzmJAjw900YyNsOVotVbp%2BPvDU%3D\"}]}\r\ncf-ray: a1f19638cc415a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10154\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10154,"size_decoded":11110,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 182x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8a01a9c05d67616ac4155d65a01708a8","sha1":"a58b08cbf7eedbb1760e54975e207991096a0b25","sha256":"343886dc97fff464d009add2c171074b1641629b97a74b0ab25a307a71a09512","sha512":"b0763ee7e6aa606c905b92d91871ece812f4470731781328112c45a5773bb1d4a3cbd7b0522768516b62b58ed8971ae4f0323b3041de6c7eae13676a52af6f49","ssdeep":"192:T4iTUrdJk9OTbinJI7j4AIEhexlNOHvl0IhZ8Fcpe7lBb6JMqrIdo4RNNXt60U+:0FdsOqnkkAAxDOwFGsZdDRNNXL","tlshash":"5022c048cc75600df2db7b65632f978f27b799454a19e8364225c847cdd8a33a24ec73","first_seen":"2026-06-10T04:30:14.14093Z","last_seen":"2026-07-22T09:58:55.750731Z","times_seen":4,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/oasis-poker-68596ad8004db670431224_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.436Z","timestamp":1784714305436,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/oasis-poker-68596ad8004db670431224_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:42:04 GMT\r\nx-rgw-object-type: Normal\r\netag: \"ae54c671e1ac81b3d4738d5afa2527f7\"\r\nx-amz-request-id: tx00000eb38d31a92775892-006a6093a4-2d6edf02-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ktZQO7oFIgmmTC%2B%2FMKab5%2F8w%2F9xy1fyd9bmYaiLG3y06CG40xa%2BR2P1gum3COohTE3%2B8gZ%2FDb8QeL6Fs9NrBX5ebRQX7dCB7pQkap5m4%2BK7q3KdNt7yBMFln2aXNeeQ%3D\"}]}\r\ncf-ray: a1f19638fc5a5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4140\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4140,"size_decoded":5103,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ae54c671e1ac81b3d4738d5afa2527f7","sha1":"a4053492ac1d53ec2d4da8ac0bac37c3d168d1ac","sha256":"0989ff996448270526c311a2ad911846583cd788acfcf25e3ddf63314f7a7ec3","sha512":"28cd72cf6731d1fccf5ac4a26023c3cffe123bf8964c44ac4bed4d14e4b66201d8d6aa2dd1565ce360aa0af2a9a3149783310387b9d304613fd707ee1e4a085e","ssdeep":"96:emDZKEUn3FeFcrD8M0H8pvxfMr8XSoPtsU5L+r9C9EB:fFsAFcX87H8p+8XlPtsU5L+BC9EB","tlshash":"51816d40d69d4080c83fc87ba7feb70a777186b7d1474a6f181bee4812aacd695cc635","first_seen":"2026-06-10T04:30:14.095863Z","last_seen":"2026-07-22T09:58:55.751349Z","times_seen":3,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/assets/fonts/inter/Inter-Regular-a1f0ef0a29e900e333f5c7dc41612c8e.woff2","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.013Z","timestamp":1784714305013,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /assets/fonts/inter/Inter-Regular-a1f0ef0a29e900e333f5c7dc41612c8e.woff2 HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rain-bet.xyz/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: font/woff2\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 16 Jul 2026 10:28:13 GMT\r\netag: \"6a58b23d-1b2a4\"\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: blob: https:; font-src 'self' data: https:; connect-src 'self' https: wss:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:;\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), fullscreen=(self)\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nage: 156\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5jHxsiM4FWGl%2BnB2GA8qPUtgqT03jiZX5gnLuYQvUbOE1widhUyiPwuKXM2ZWrNY2SLLovawVn82cphZpcsAySAXFwuDnRbAnLqwBvBb%2BqygJGU3CUfxf%2BeTjgvSsx8%3D\"}]}\r\ncf-ray: a1f196364bb35a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 111268\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":111268,"size_decoded":112535,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 111268, version 4.66","md5":"3875f83574973c732136a45f628e64a6","sha1":"b7a0b6fbebc40eb29b76cf135c4b7be50b981b4b","sha256":"e06f6b1bc553aaea4e4668023ed0ab0a147129c3107f511bc7d03d361b0ae085","sha512":"c4d06c4d73f83f3bc150ec5c3fc792af04161ec98c298a526b717b09e0f10597c688ea1827c1b54324b809cccd7c8a51e637eb822f192744f16556d0fd5b2efb","ssdeep":"3072:oSVIcbST1rITm6KORAGB/6lp7l8MBrVAPg:oSVIcEwm6xlB/6lp7lzBJ/","tlshash":"2ab312cd46ab0e22c7db93b491ea634d5ab188f8e3b630358993ff31155093723e615d","first_seen":"2024-11-19T20:50:46.185622Z","last_seen":"2026-07-23T10:41:17.338441Z","times_seen":65715,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/food-coma-68590f273876f902404170-685d5432b4617361421731_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.362Z","timestamp":1784714305362,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/food-coma-68590f273876f902404170-685d5432b4617361421731_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:39:03 GMT\r\nx-rgw-object-type: Normal\r\netag: \"fdf670ba1b3071fe2f62f33ea0b016f0\"\r\nx-amz-request-id: tx00000d7a5fbdfc5e1dc70-006a6093a4-2d70dda8-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WaqD%2FpCytWE5%2Bb54u6%2FFjNq6w3XhegXG4OnD%2FZs09w6DSaHZmDA6820pbk7Rzgt4sfyILfdBGq%2BvTumRjWZFt4fxfFqqGUKKOuPm08x45CiWsMieFy%2BWNLEs8nPe3oA%3D\"}]}\r\ncf-ray: a1f196387c2c5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7790\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":7790,"size_decoded":8749,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"fdf670ba1b3071fe2f62f33ea0b016f0","sha1":"aff03ec80ffe8e2cb0f2f252eef98157db80b691","sha256":"e8d83760c0496299d2eafb3ec3176102e57eb548c3eddf8fd6af274b7c7d31f8","sha512":"448ef113d4cee5e402b918df753b9ce6683a88b0dfce1e4e8567df8782fcfea8b02ab6364ade9b157b493ae759962d53379cdeec8a7583cbf00a464ef01078e5","ssdeep":"192:JpNJNRh5fNxoeiS5F0cTbkxAFdbhLH1ZXm4dGmEjpTcs9NHen:LNVLFxFFtT2AFHBVm4kxjF9NY","tlshash":"f3f1ae03e5b31b0417084574e0e08e0dee6a967beca5ec50d1763a7b6d632e7112bb7d","first_seen":"2026-07-15T07:58:47.774214Z","last_seen":"2026-07-22T09:58:55.752572Z","times_seen":3,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/chicken-road-6859074c2fcaa588383894-685d51df6ce48758599339_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.377Z","timestamp":1784714305377,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/chicken-road-6859074c2fcaa588383894-685d51df6ce48758599339_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:55 GMT\r\nx-rgw-object-type: Normal\r\netag: \"c807a8dc4b601c73c92047758027e60b\"\r\nx-amz-request-id: tx00000b0cb69f53207c25a-006a6093a4-2d70c54d-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a1Lb1TIGAWVjFFLJqpVBVLRWpE0g9H0lBoQTFj2R3l6KaszLLp4bPy4BO0Lqk88qqjffmpiBvNIYcudaDOuCp22sQahvMyVsVs4WnsCpyJRveNotr%2B1PHAsWtjCfi04%3D\"}]}\r\ncf-ray: a1f196389c315a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4646\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4646,"size_decoded":5595,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c807a8dc4b601c73c92047758027e60b","sha1":"21736982ff36e6e5247ba7c2154098047aea30c5","sha256":"a729577995104e54cf558a76fe2967e0a77e144a8ac9fa4acf674986e744e6d9","sha512":"95c8310493b9961c42e57780c1c6914d1a94eea1314165f28f54a3078f73645d160c64da17c62ff825914c6d69b2e23ed9311ae3d0352772f8cae9bb92693c2f","ssdeep":"96:/b8OqAFoVz0BrM5eGS9b+64i8vLqy9D7EZuTRrexWa:/b8fvJqzPyN9DoZapa","tlshash":"94a18e3d9c54f9c1fa1ae607d6662fb3f6574e1cf06eb8100b3870ed04ce51a2654155","first_seen":"2026-07-15T07:58:47.833366Z","last_seen":"2026-07-22T09:58:55.753385Z","times_seen":3,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/5-wishes-68551ac9c607c277396054_208x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.392Z","timestamp":1784714305392,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/5-wishes-68551ac9c607c277396054_208x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:36:33 GMT\r\nx-rgw-object-type: Normal\r\netag: \"9660545a07601c4758a4f6dd4b23d3e1\"\r\nx-amz-request-id: tx00000afbd5c8533178ee5-006a6093a4-2d6ef057-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 157\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aaZ%2FN95MkW22Y6igV3forBFLfo3DMt%2FvtX1W1zKeFm6PgWuKKy8BB%2FZtdMJ1tSw7igi6xr8OD6QLh6%2BqX7qURHEWEN1wzWv1nCpRxeNmLdedkr0sXi9n7VJZRIYzhGA%3D\"}]}\r\ncf-ray: a1f19638ac395a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 16716\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16716,"size_decoded":17672,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 208x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9660545a07601c4758a4f6dd4b23d3e1","sha1":"b1a024b3ac92ef8149a262a5e2752ce5e1a325fc","sha256":"6a7e8785c04159f2fa5bd305a22ce6ba3e14b33077f63d4147cc1484d1bd6886","sha512":"2add04034940ca3a325ec8986e6397a7f6a089f6b63aa7ddc4093cd3ee93cb736ca31e425d6554702e9aeacf87dbfb031de69c5d8a3282047f347c1e3ee3b19f","ssdeep":"384:6v3iLC/Jp/zLKSi+uam0HaFLAS+jX3Wiwy6JEpVQq26G9vQPPFJ2KOT:6v3iWxpLWX+jH2LIj3wy6JE3QIG9orOT","tlshash":"8f72cfa26d025a27dcac3cc48647b1ba445b56b7be8ffe477db50c2f368000972ad218","first_seen":"2026-07-22T09:56:21.402951Z","last_seen":"2026-07-22T09:58:55.753975Z","times_seen":2,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/super-7-blackjack-68596b43cec35598782103_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.415Z","timestamp":1784714305415,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/super-7-blackjack-68596b43cec35598782103_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:42:10 GMT\r\nx-rgw-object-type: Normal\r\netag: \"2afa96e1e41ea37ff7e78e9da507fde8\"\r\nx-amz-request-id: tx000005048b3a568f2f749-006a6093a4-2d6eb7a1-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZTISxQcz%2F8A%2Ft4XXwnLnBDk6k7oMRMsHeKVvcDHGBIZUKukt6VfVu%2Bl%2Fd%2B6vZimBC707ugIoh8rBEWuQ8%2FmdxHabilWy76Gyy6NSAAX%2F4in1MLAcnWs%2FuEPbUxgtrmc%3D\"}]}\r\ncf-ray: a1f19638dc485a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 5064\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5064,"size_decoded":6027,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2afa96e1e41ea37ff7e78e9da507fde8","sha1":"cf18dc72da03bc308d4dcd933b5994f1d93912fb","sha256":"3b61f224cbc4307d336ff4c5350057bcd0eb8ec1618d98d27e7c14d5ef0c027a","sha512":"5172c4672a74eb515b4d59b67d8b8428a7b7bd8b8f8f4472da31b038aaf5921eb431a7bff19c76f3096b126fc33afe21a0727b2332a5d0839721741d441ced67","ssdeep":"96:8QD8+AkMModNlexUhJmaR+sZJAlemJlaoa00+cZbukBl31:VD8+tMLle4CqawP3gyll","tlshash":"eca17d358e8e6e54d60e5cc64915e93342b0e6f85474616174a88b135583b875e323ce","first_seen":"2026-07-22T09:56:21.347136Z","last_seen":"2026-07-22T09:58:55.75467Z","times_seen":2,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/pai-gow-68596441da1c9821417398_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.420Z","timestamp":1784714305420,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/pai-gow-68596441da1c9821417398_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:41:30 GMT\r\nx-rgw-object-type: Normal\r\netag: \"415e64d2aa3f8b3beb3e2a60fef2e3e0\"\r\nx-amz-request-id: tx00000ce793d423967df5a-006a6093a4-2d6eb445-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kHoo6GyRuXKz9tEZ71CNE66G%2FzC2UBUKS7PsqVGH2x8wIlUYTGiPX9hU22wW9%2FgXuVp7qNx0Se0MN9wobV72Ng4bAawyIaLYuxBLYi4w6GKEuLPvzDpcACZPbb5nfaE%3D\"}]}\r\ncf-ray: a1f19638dc4c5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4906\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4906,"size_decoded":5857,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"415e64d2aa3f8b3beb3e2a60fef2e3e0","sha1":"04b2a2bd8bd7b37d5faf635476cdcb9c5bc15248","sha256":"8e8ca50af98f8644d83f868724aa9607355a1606a1557a30963a908ef76890b9","sha512":"dc13c4e96fe986744805f53fe38c707d217ae029f8018aa70e917368e46493f9a7999740eb769b2e86dedd211e0ca0d2f92bbd56cc9cea30742368ea0ef81448","ssdeep":"96:UlJZxNajXUJ/+uon47ckcn3z81mHxNFCUZDmWT/awcpGk156DXl:UlnsXj4gkWnxNFPZDmWbqr1GXl","tlshash":"74a1ae4c7e80a7282bf2ad3c4e91ba4a4c285319d714835fd5b7a0ab36355a6c03d390","first_seen":"2026-06-10T04:30:14.142763Z","last_seen":"2026-07-22T09:58:55.755438Z","times_seen":4,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/mega-wheel-68558cfb2d727937412853_208x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.302Z","timestamp":1784714305302,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/mega-wheel-68558cfb2d727937412853_208x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:31 GMT\r\nx-rgw-object-type: Normal\r\netag: \"523a00e07b16689e4af2ff8b4dddde1a\"\r\nx-amz-request-id: tx000005996be3c08ed13d5-006a6093a4-2d78bc46-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cZ4eUIdcBTgILcTqhO5Xq9KuYHJmOhT6PbmEemlUSMnw2H9yMc7mThRd2mGhinN6E5UZFHg7r1Hvl2aLDsqGa4IKXoDtnzqitpIqxjVjJf0H3ig1NVj9Tkpc8ZqmnHg%3D\"}]}\r\ncf-ray: a1f196381c175a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10270\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10270,"size_decoded":11218,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 208x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"523a00e07b16689e4af2ff8b4dddde1a","sha1":"ccfd70fa46f0d03d40bfc46d4e1387a5baeb7622","sha256":"d2e8a728a3059fd052bc75935cea91ed9beff8c890187db75cd5130dc2c01eb4","sha512":"fd685a6f9cd9b98c1e7734c4c3065e9705702980b5fd8c051703010673dde8999b344388c56294ad8aa42fcc5d7b1354cf748306166112cea3f4edd13c21a016","ssdeep":"192:zF45ekL+UPJgC4fQFvg2sEi47xRcB6z/0oS1pNGxfvaJEK+o3frHS9a:zF45eelOPEi49LztmmfvaJEK+o3Lka","tlshash":"ca22afc1741c0a70d2ef9ff0a32f6b7822d2c72714de92954e5664eaaa6c534176058b","first_seen":"2026-07-05T04:13:24.996233Z","last_seen":"2026-07-22T09:58:55.75602Z","times_seen":5,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/football-studio-dice-6855093849cde899093706_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.307Z","timestamp":1784714305307,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/football-studio-dice-6855093849cde899093706_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:36:03 GMT\r\nx-rgw-object-type: Normal\r\netag: \"174313cffa9ee05b03471c81b871f5f7\"\r\nx-amz-request-id: tx000003c3387a1c54ddbe0-006a6093a4-2d788d34-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e1cMQSLpVfuThjBfegSnQUSnDfDkTdW27kcMEIACDOFaqK%2FPbUuqHg7rE4hTvyjgnlofj9lymajvsxRtBj7prpnWupgOd%2BxGc4gKZcsybUj26j%2FBvh6sZKf06coySoI%3D\"}]}\r\ncf-ray: a1f196382c185a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8394\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8394,"size_decoded":9347,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"174313cffa9ee05b03471c81b871f5f7","sha1":"51b2d0d9d538ea0ce180c57fc99e331079aa0ff6","sha256":"23b0ad3f3f4df5d80a6adfd5e3560311f87b01d7850e43e23f0c2ab60ccd6181","sha512":"6599f54a4af3c9a55d48c8aa576beeb1791402a7e0606ec58a52f7c1cb4a8ec5681dd688b2f0311abe29dde136ca402f77475f62be8ff801456686e9aef4ff16","ssdeep":"192:E73OsHAlW/u4TjR4Y7banzExaLbigcboPkp/2If:YOy4WW4BbazEq1go8p/vf","tlshash":"2f02c0609a0ca04f7659bd608f67f17e12b4c78bc916c0fc33c57a0519e468a14cf4e8","first_seen":"2026-06-10T04:30:14.155387Z","last_seen":"2026-07-22T09:58:55.756569Z","times_seen":7,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/evolution-first-person-lightning-roulette-490x556-min-6858f0f1274d0084727472_156x137.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.341Z","timestamp":1784714305341,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/evolution-first-person-lightning-roulette-490x556-min-6858f0f1274d0084727472_156x137.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:42 GMT\r\nx-rgw-object-type: Normal\r\netag: \"51d9f8c4492987c3448c134baf93cfa4\"\r\nx-amz-request-id: tx00000828776238c9ea231-006a6093a4-2d6ecfb1-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IpZsQ69iEINGrSdr8tbnhc7RTSoD%2F7LlEVHFULrany0MwqnNmiZxoRAKDAd16bjSl%2FUINpm9UlvQf2qouu%2F98MqsQ0d2a6VK8H5QfgF%2BqOAMC69mqEX1xD8cB42eVIM%3D\"}]}\r\ncf-ray: a1f196385c235a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7052\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7052,"size_decoded":8007,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x137, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"51d9f8c4492987c3448c134baf93cfa4","sha1":"4d341ba1508a65b3f66f8116b8ad3dd6675be46d","sha256":"6a7592e8c8a368ff5c9be07e6aaaa7c7f321c9e5737bd34e63a10caa1d7bac57","sha512":"46e270b9aefd8946d63f7e059d1b5905cadec7262da7135ca4e576258a7536acfc69933c6ab06a2c2640dae247ec3b19812356597a4c7b627d5c4d4312efd982","ssdeep":"192:LOgPqhMnKndho6tp/M6Y7zZNG8gTjteHiQu/sTAZZI:fP1MnoG27zZNGFUnu/sTiZI","tlshash":"37e1af56631b4061c7addf2d8d8361226716ed67e30a709c7513d381468e67f980e22b","first_seen":"2026-07-17T01:07:08.91246Z","last_seen":"2026-07-22T09:58:55.757215Z","times_seen":4,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/sweet-bonanza-xmas-6855013ca95f8240711838_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.395Z","timestamp":1784714305395,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/sweet-bonanza-xmas-6855013ca95f8240711838_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:35:38 GMT\r\nx-rgw-object-type: Normal\r\netag: \"efaf6ca3359ed23714b2f4996ca54ada\"\r\nx-amz-request-id: tx00000224bdcc1bbe57ae8-006a6093a4-2d6ee1ef-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dXokz4QlaIsAmg0b7E2sEnltI2mXHGFPj7YQLVTWCsi8Nf5hGD9IjLt70%2F6%2Fbm8noFyieH8En4TAckjd7zt27nNQseAUg421MJW6Jbe7GIEss8KFjNMWTMNwqPhjFnI%3D\"}]}\r\ncf-ray: a1f19638bc3c5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10630\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10630,"size_decoded":11582,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"efaf6ca3359ed23714b2f4996ca54ada","sha1":"d114c29cbcd4fa0cf35d0b4e825ab319ffe2240b","sha256":"a8f278a346a774f153b6a2e1b7825dbe3cd7c3463c357ffe7281ed01b6723adb","sha512":"57cea5c580b4be450d14b893c564a57df74bd0d4c45d47dc1c28089366ee8078e7815d8babdeb2ba0cba561ecae9dcd3c2fd6160686f75d00272588034617d37","ssdeep":"192:5LsPdNYuav5BlmJgvn1zqOxDMqTAW6grMaka4rIiPLaAkxxREXp0tbwLonp7Z9U6:WonsgvnZpMqUWprfqaBD6XMkonp7jEkV","tlshash":"9b22aebee0b941a86bcb0a74544c2fcc47c98d24b32affdc14b519698966fcba3d5130","first_seen":"2026-07-22T09:56:21.364112Z","last_seen":"2026-07-22T09:58:55.757944Z","times_seen":2,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/midas-fortune-6854ffe9e3aed279408278_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.398Z","timestamp":1784714305398,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/midas-fortune-6854ffe9e3aed279408278_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:35:12 GMT\r\nx-rgw-object-type: Normal\r\netag: \"0ad884b4708621ebef25043a26e03b39\"\r\nx-amz-request-id: tx000005c014bd942319e57-006a6093a4-2d6ef3b3-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6QggdNxrbvUo4hllhNAhbnZTrGA08ysKiX9JUDQ9NJueJT%2BkjYc5SaZ32ogf6dew0zcrc16SrT8cFtZQ8rE%2FZRxqIjUb1QIAu%2FZunVf7Diit4qlKOeJIkq2D9kTJBRE%3D\"}]}\r\ncf-ray: a1f19638bc3e5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12068\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":12068,"size_decoded":13022,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0ad884b4708621ebef25043a26e03b39","sha1":"b98f85057f230a62b4b4cfa1f38eab3815ea4f69","sha256":"d26f02fdd9cfe99e1f4dc1031386e3548ffa0adb30e2dcb50ed363acb6658b0e","sha512":"e37149e406ec0080e4abf6f9709aa5fd05c7028e79ce885ba23db49aa52ef204a724ad19e32c5e1d6a9361fadb1cb753d85f6349de2ab94ed158ea9f9d7feef8","ssdeep":"192:skNKwj4w8aHONgL11M9UkWTE/BCd6VV8T62yXSTjrVUQycwcyIJlc8sUMIMYsc:skNKwf8OOqOVKcSXrVycXvc7U9Bsc","tlshash":"a842c07b4f69af4c1c2cb27178a50ad4404cec0c89491a055f378ef232f49c96169aba","first_seen":"2025-11-10T15:09:50.417408Z","last_seen":"2026-07-22T09:58:55.75869Z","times_seen":5,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/boxing-king-6854fca962c15605971395_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.411Z","timestamp":1784714305411,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/boxing-king-6854fca962c15605971395_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:34:36 GMT\r\nx-rgw-object-type: Normal\r\netag: \"961895149543fc402a06354532b4b363\"\r\nx-amz-request-id: tx0000029db781267e2db14-006a6093a4-2d6edf5c-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FW1l%2F8O51uYoofw8HDvCC2f3WPgyDaSqmF5NkRn1raPzn7vy6qTP%2B5a6GXJgbYrf%2FnfKPGz07%2BtmIGzfU58WVXc5u2Fwqb2NAYoYVsvdW3va3NEVKLkSwSepDf%2Bd6Z8%3D\"}]}\r\ncf-ray: a1f19638cc455a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10974\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10974,"size_decoded":11932,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"961895149543fc402a06354532b4b363","sha1":"3298e308e8d73fc75be478ed67ad1bb16daf27a5","sha256":"1977531589d59bf835f64030e90b5bfd4a20ea512919db95cc35136aa616b382","sha512":"3cf4330f00347f9bec8c28e53c448a19ae9470e8964199bc7ba9bad0d576edb7eba90e3e0967786d0620600da62182036a2726d1d76fe3a799d4196f7719c845","ssdeep":"192:gIXMzC2mrMbXa3jabwPYN9n2wFRxVG/Kxc72v7UHkw8YVUR3o7TXFoJ:VcUKXaTaOYj7Ln0L0wHkwPzaJ","tlshash":"e132cf16aebc479eff96bb66dbc547200e113d81d6f07ad27b82007b67088e9070b264","first_seen":"2026-07-22T09:56:21.351724Z","last_seen":"2026-07-22T09:58:55.759513Z","times_seen":2,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/speed-baccarat-a-68558dedb0022090442399-686b716643a5e879674722_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.279Z","timestamp":1784714305279,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/speed-baccarat-a-68558dedb0022090442399-686b716643a5e879674722_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:38 GMT\r\nx-rgw-object-type: Normal\r\netag: \"7b8da633aad431968ed4eec7114bcef4\"\r\nx-amz-request-id: tx000003e08de9378769410-006a6093a4-2d7890f4-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XYS9gVZhogl2Cm3jWWuvvDblGZxCDqel3JQcCMfwO0MHa8%2BfnvZDfbeCsKWCqPhqtP8aoK45Krf0czeKOE563Wx3Vo0FdBJB%2F7N9ZKemg5VJEO%2BFoSWRoYKJwqNvNHc%3D\"}]}\r\ncf-ray: a1f19637fc105a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8558\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8558,"size_decoded":9511,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7b8da633aad431968ed4eec7114bcef4","sha1":"db9acaad80ccf1a50332f9054c041201991b19e7","sha256":"f146c0fb706ee025dcd50fe02c625995457a7fe388a99e7481ee1ef0db457330","sha512":"99a1b6196225bc8105eb9e8ffedf71e97af3d71d688c6cbaa3ce8eff3047f94fa51e31710bf0827f4bd6c496e6b86d724e67bf71fb6514d6252f2d2666fb3839","ssdeep":"192:Rp5i0jxZf+IfNCSOiY+PZnz6QuWGKsseMZEm:rBjHW6fvYenz/XGKrLn","tlshash":"e902c06ef2e32133ccf1dae2d6794a5c5348dd0a51b0f6056c52b8c113c7ba232aa81f","first_seen":"2025-12-08T06:56:23.215149Z","last_seen":"2026-07-22T09:58:55.760512Z","times_seen":6,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/crazy-time-68558b057bf05305786243-686d218b46d54253888348_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.312Z","timestamp":1784714305312,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/crazy-time-68558b057bf05305786243-686d218b46d54253888348_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:22 GMT\r\nx-rgw-object-type: Normal\r\netag: \"369216ab11f2bffd5a6e2c64708616b7\"\r\nx-amz-request-id: tx00000e8772c53ae254b38-006a6093a4-2d6edb76-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zcQznW8FCHKDDoKchYOrJVjSvdJq%2FZznJJcjs9vIh6jAJeg0gpyxfF0ph3rsc%2FLSHcE78wisD3T66ghVmkK9CBotpax1JPgUpzamb8bohzFnycFl9BqxNb%2BnfNIf8HY%3D\"}]}\r\ncf-ray: a1f196382c1a5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 12024\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12024,"size_decoded":12978,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"369216ab11f2bffd5a6e2c64708616b7","sha1":"7ffefed117fa0a1a8ad90c2737c6118b2815f567","sha256":"84656e5d9b239d83fd3170ec09ee73acf1dd441d674c4bc7ae76bda19ec1f42e","sha512":"c2bb030f4ee3dadf4ab725cbca891acbd3252374f389db599931deb9740ca60cefb9d39919f4e826bfd9056bd48f5e8270277d847a9fa774fa424762f0fcd97e","ssdeep":"192:ALOlvCuWLMdojoybx3hUKoaP+ZCt627BywnzYPXti/FdIe0A7WpJhN2+vymQheJ:APu2+od13hUKoS+ZCtJBrkPXU/jf0iWf","tlshash":"c542bf3d1a18f005a768c729097baff5a24b59306f66d983db071499b34ee310f73e28","first_seen":"2026-07-05T04:13:24.984237Z","last_seen":"2026-07-22T09:58:55.761086Z","times_seen":4,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/lightning-dice-68558c902b2d1962605045_185x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.343Z","timestamp":1784714305343,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/lightning-dice-68558c902b2d1962605045_185x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:27 GMT\r\nx-rgw-object-type: Normal\r\netag: \"3d3afb14ed2f1b1bb3d7abb4fa048570\"\r\nx-amz-request-id: tx0000098bf5ad592cdea6f-006a6093a4-2d6ec5ee-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=swvsep0x3vd2F7Bi3FKCJRHWMFFhWbZQLljEt0BPD7vrzu8WisT4PyhiW1ZmyrhbHYvKbecYnMHkCRD4nxQMsEusjXq5CKXoNDbv8SgmD9uRo6EmK0OUM6%2Bj5FwRxLY%3D\"}]}\r\ncf-ray: a1f196385c255a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8350\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8350,"size_decoded":9299,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 185x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3d3afb14ed2f1b1bb3d7abb4fa048570","sha1":"6087aed4c5686dfe019a3603121d1df1ae82fbda","sha256":"2878721d78eca701dac6490794ef8c13dbe87be91a589e867c242cfcb7205ecc","sha512":"112fe46a24daacdd119523d6c2ea87107f9614453c72c1256ebfa5aa5d3fca3a822312763bc251e9a5040d92637132485430af0761d2a602728c8ef91dd16f68","ssdeep":"96:mlH+CJF6Q1rpEE9Y0g82qXfGLuiuDy421276Odsa8MnclWQOXGNaI+zgLiN3vkYi:y0Q1Ca9lXfGLMh7zUWtWNaI+zgLiasYL","tlshash":"d402af3136e82558979d6d195eec04bd727a7cdc461bafad4983c9cc05c9304b38e7e1","first_seen":"2026-07-17T01:07:08.93551Z","last_seen":"2026-07-22T09:58:55.769561Z","times_seen":3,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/limbo-cat-6859125608b25332924495-685d56e53b8a7322799757_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.357Z","timestamp":1784714305357,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/limbo-cat-6859125608b25332924495-685d56e53b8a7322799757_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:39:28 GMT\r\nx-rgw-object-type: Normal\r\netag: \"ee1e73542a27cb8daeff9914274322fc\"\r\nx-amz-request-id: tx000005508919776fbfa1c-006a6093a4-2d7890f4-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Mqr69ceV48vw3uKQpL%2FwuQVaw9e11LkPxBBgTYfRTiStwXl5SuvL1ygKYNeRTj9GcfJbabj03DO8vrwOEJBbwtQQ%2FUCLo%2FYIaXmS6uzdSl0Qz5Pv2SDvpX1lwc781Wg%3D\"}]}\r\ncf-ray: a1f196387c295a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 7476\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":7476,"size_decoded":8429,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ee1e73542a27cb8daeff9914274322fc","sha1":"45e3edc8b171864c472acc38b0b4b52dc4c20521","sha256":"b123dd0a5f89e8b76cc4a24a569ad22917fd7c5c13ce7bda4fbf75ad250ef79c","sha512":"f26dc67aad8aa456b87fba1d1b554a04f52ae1a1ea943cc075437782e3403afb8d6c113a90f2d3ff38f03302feaae704e421822773ca6720ae5456d7972a23b2","ssdeep":"192:z0S4timteHDNl7VrYEui1PETXW1tdFRfqUsnN:zMtiaShl7V82SDmtAUS","tlshash":"70f1bf55487e887de7793d1b18d8a0e5f6034c35854824ced6f36cb5c523d8b93822ac","first_seen":"2026-07-15T07:58:47.74625Z","last_seen":"2026-07-22T09:58:55.770362Z","times_seen":3,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/dragon-tiger-evolution-vip-685969b7d2e97898329600_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.433Z","timestamp":1784714305433,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/dragon-tiger-evolution-vip-685969b7d2e97898329600_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:41:47 GMT\r\nx-rgw-object-type: Normal\r\netag: \"0a6804e0f3ccce51a5ea7f066e132958\"\r\nx-amz-request-id: tx000002cc8b53426beae43-006a6093a4-2d6ecfb1-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RtnkvBWjs1Y9HPZSB6Rzlul4Uxf1OPrsqUgcxxomPCj%2F3R2EQWCZ1D5ivrnXJW8ULo3pVBAQWdlJCdevVbNaFdWGHvPPZnaTt524sIECpmDi1A0td4uifDXiK5N8Hgw%3D\"}]}\r\ncf-ray: a1f19638ec565a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11092\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":11092,"size_decoded":12042,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0a6804e0f3ccce51a5ea7f066e132958","sha1":"30a306de2ac86a259ef2f828424b7654414e0f9c","sha256":"f3fb41c59badd408a8d5bb8091d2b4a89a832ced5d65125ce39b033e26cf437d","sha512":"1383f9b8ba65a644543d6d54786e9c3bc0c8a8a79239c05fe7b6a2c5fd45c73009e1e103dc0f46dda5b256b8bdbe7f4779c4d00a6c91884a2247ab820285b013","ssdeep":"192:czUHtYsV16ZEbEtgHutBgy0xvpbN1itPuHmnoSPH+S+iWuAxmyvYooygJ93+:BSsT6mb7HweymikHmnbPH3rWuuQooygW","tlshash":"5832df5913eb8d45cc9f430b4a3de492ce584d9ecdc154cfa8888c7ef0593cc26996d2","first_seen":"2026-07-22T09:56:21.353942Z","last_seen":"2026-07-22T09:58:55.771251Z","times_seen":2,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/welcome-daner-11-69ef50bbd59a5472266681_1534x312.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.018Z","timestamp":1784714305018,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/welcome-daner-11-69ef50bbd59a5472266681_1534x312.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Mon, 27 Apr 2026 12:04:13 GMT\r\nx-rgw-object-type: Normal\r\netag: \"bed279a5cb7fc6e3c041d87fc6eb985c\"\r\nx-amz-request-id: tx000009bba8a38f8a98ac1-006a6093a4-2d6ef3b3-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rAqtamwd9DxYlkBcCTj%2Bseykb9l%2B6%2Bs6m2AEJv2KrOIhIi8zN%2F%2BByObwRm75V7B4YlOZUJi%2BrWobG%2BszhWFZZgTgF1t1L6hma8%2BTcCcSfDUVDX6JVkSjQJZwYhXB44k%3D\"}]}\r\ncf-ray: a1f196365bb65a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 25884\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25884,"size_decoded":26848,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1534x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"bed279a5cb7fc6e3c041d87fc6eb985c","sha1":"f704b5cfbc533ae2ed25e49f92e673e59ecd3dc9","sha256":"6bc174b158445ae37a038979e4c3e636761d7eb5b25e3d9d890985bea61997bb","sha512":"e7eaa2700d76afad2d01dcb58c5953d840cb6bfeb77fb1b450637213ce025b0b94f830f4fc2fe3907a5c13a9c9c6821f361c8d264ed0826955b3bd012c9b0cc3","ssdeep":"768:rdRdZSHjEzQGLVOU1MpaaTDCTZ1RNiTPnZXcn8:rdRdZ0jEzdVDMaoDCTZ0TPnZt","tlshash":"96c2f1e0960003da7a571443355fe9eae1c19a389ffec7986e215001b00e63ef7b9dc6","first_seen":"2026-07-22T09:56:21.388521Z","last_seen":"2026-07-22T09:58:55.772059Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/fortune-gems-jili-686d28e660e4d550191492_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.409Z","timestamp":1784714305409,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/fortune-gems-jili-686d28e660e4d550191492_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:38:42 GMT\r\nx-rgw-object-type: Normal\r\netag: \"e0bcb003882203cb035331a0039ef3d2\"\r\nx-amz-request-id: tx0000074f08467e1493e41-006a6093a4-2d70c813-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RuiWT3Z%2Fgb00ZeK4gkYF674eMQS59QOvyDePyXMfwm3%2BXJv8mBwWrvQU4O9JX6lzpZP91MVQnKHj1h6l2bpzLC7HSXiY2uzwR%2BwgyerI6Few%2B9m9w7k8xyG8zYdlIoE%3D\"}]}\r\ncf-ray: a1f19638cc435a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 11356\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11356,"size_decoded":12312,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"e0bcb003882203cb035331a0039ef3d2","sha1":"9731fcf98563f2c5d1892b0608e1a69509169c3d","sha256":"19bf4e944357a3ab21f5011a6364a4ed62a6d977432a085cc7211903a22301c1","sha512":"6b4ad5bff908ffe7445dcb134db56a30fe30aa009378616cacd8a8aa3074fb5aab84fbe792d8ec94e09234fbba382b0a8d71bf0cb7b31f2f1a453607eb6fec6c","ssdeep":"192:dnljKJFhcrxvfUEQ0sYCWN6+vCxp+no4pvxnOl2h9OcA2NOTnhZ1Yicp7Et95Rzu:dN0crx/QAv6+vC2htxnOl2Xllg1YicYs","tlshash":"be32bfb2e38e83b4a8c796c125fc863106e2f79903583111c546057873da7b7ca67f26","first_seen":"2026-07-15T07:58:47.79762Z","last_seen":"2026-07-22T09:58:55.772749Z","times_seen":4,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/book-of-ra-magic-685525b839f29576358865_182x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.414Z","timestamp":1784714305414,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/book-of-ra-magic-685525b839f29576358865_182x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:36:46 GMT\r\nx-rgw-object-type: Normal\r\netag: \"f8ef4dce5cdd33888d7794ed4463fb35\"\r\nx-amz-request-id: tx00000fb5b8ade00899222-006a6093a4-2d6ecf93-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0AtsO9qQ3fZ2G%2BVJdY2Qb29zQS6EepiUpk49XtgxU8b0VQr4EzquYJ8BSZwSiXn5u3qAql%2BRBFbcw3h%2FB12mQbmy%2FNsQ1x9pv53clRHBrgJnCFe%2B7B8%2F82UffnVB3Zc%3D\"}]}\r\ncf-ray: a1f19638cc475a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 9428\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9428,"size_decoded":10387,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 182x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f8ef4dce5cdd33888d7794ed4463fb35","sha1":"537e99385ce76563b29792ca998e293a73e38dab","sha256":"0817357a6481bf4e56a011735702d15672608a4481f2e48d7f14b5b1b0cd868f","sha512":"c0aca6956612ee895cd5e95331131e94f2b6b987c53f39d0bd3d8a73ed3b98caefb8e9dda49b66d44c8b808e68eb94c21bcc57b622cce849656d6d58d702ab32","ssdeep":"192:lVXSfyoQvFm6GoRsanTkIfCQmT6X29CGiSR9FlMYferMzEO1faf6:lkPQ/Jsan9K7TVciRXXfHzpY6","tlshash":"9a12bf339fdbde8e42dc965959e09f6c1448de149334853e8f07ce1a9ae1b27f4a0620","first_seen":"2026-07-22T09:56:21.364992Z","last_seen":"2026-07-22T09:58:55.773547Z","times_seen":2,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/european-roulette-685969c805ec9708789419_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.418Z","timestamp":1784714305418,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/european-roulette-685969c805ec9708789419_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:41:48 GMT\r\nx-rgw-object-type: Normal\r\netag: \"b7dff5c9854d2521cbf7c480a5b3adb5\"\r\nx-amz-request-id: tx00000a85e68167a9053e5-006a6093a4-2d78aa3f-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QJMlddg%2Fsufx03Ed0ZqLsoT%2F%2BwZxTvAeNmkrAIMPXwSgx%2FWtjj1pPlFrLv89H375ZlOe7bAh9xf7QwiPCzik3czwWvE8%2Bcx54xjgt21earbdR8i9xp25tLj9gfraP8g%3D\"}]}\r\ncf-ray: a1f19638dc4a5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10444\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10444,"size_decoded":11402,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b7dff5c9854d2521cbf7c480a5b3adb5","sha1":"0029ee30279c7bfd5922b2f740d5d458a60afb71","sha256":"60d42f9bdb5c512b0023ea07523954ce4e20241ac7307cfd862d1bf726482d7a","sha512":"32db0d417a86a2ca12a5864f2b98c7315c5eab90cbbf02d39a9e3b1ee57af4104dd818c81ee8416c78644f75eac85faadff12303795a3422f576e40f6aecdaf7","ssdeep":"192:w1YaqEFuQpLE80dc3UV0QR33jxGXs8IyZrJRtbs/+o243VzlWHjRjIERNylhRJ:w1LnOoi0QNN3yZrftbo+1IrWNFRcl3J","tlshash":"f622be06bbcf93523e069a79906e14efb975593155b93e992d076c63b8db008380347b","first_seen":"2026-07-22T09:56:21.384602Z","last_seen":"2026-07-22T09:58:55.77427Z","times_seen":2,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/high-low-dice-evolution-68596311c0ec6137211552_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.423Z","timestamp":1784714305423,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/high-low-dice-evolution-68596311c0ec6137211552_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:41:24 GMT\r\nx-rgw-object-type: Normal\r\netag: \"15e3b1d82682d047c56d229c01ebd5d0\"\r\nx-amz-request-id: tx00000012790ff94a2eb30-006a6093a4-2d70c52a-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WibrHOyfJIImBRU1JAe4QaAWyx5xvYKVWuY8T%2FyiQp%2FrM44C0xtaZy4KfTAd6Q6d1mQyo0dSFDZnAd0%2BOb7Sn1JYGm5o09UQZwXbm3KaSe%2B4PuPinzeSKBIzzXHmspM%3D\"}]}\r\ncf-ray: a1f19638dc4e5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 6510\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6510,"size_decoded":7465,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"15e3b1d82682d047c56d229c01ebd5d0","sha1":"979025e54276a6bf068c91954dbfc1ce7cdf6599","sha256":"4f6f3c6916273c4f950fab71aa84c702380c48eb2daf991149fca7c37c7f11dd","sha512":"a11bebf537959d441e1099e8a7b2580ee366a723d1a490b3449ddfc2c9bfcb559df641c4a15f5815251f97c4238659f4138aab7fbf8a6d2474c046811c36d705","ssdeep":"96:/ACdV9FErzV5QqVyMYMywer3SdwO0xIm8ITzf0qoastEvGz01l8Ai4gUs:/PdVOVeqVyMglSKzxI7mlVp9s","tlshash":"3fd1bf207db4769f2416ba42d120cb278814739ba09fff1f845e90a94c5916faf0c97f","first_seen":"2026-06-10T04:30:14.153245Z","last_seen":"2026-07-22T09:58:55.77513Z","times_seen":3,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/media/first-person-xxxtreme-lightning-roulette-685962ad5fe1b710339261_156x156.webp","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rain-bet.xyz/","date":"2026-07-22T09:58:25.430Z","timestamp":1784714305430,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET /media/first-person-xxxtreme-lightning-roulette-685962ad5fe1b710339261_156x156.webp HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rain-bet.xyz/\r\nCookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:25 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\naccept-ranges: bytes\r\nlast-modified: Wed, 15 Oct 2025 11:41:21 GMT\r\nx-rgw-object-type: Normal\r\netag: \"9e410da38a58d8fde263a10181fe2394\"\r\nx-amz-request-id: tx0000002096ad0686193dc-006a6093a4-2d6ef057-fra1c\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=31536000\r\nage: 156\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bOpco1FLXMhwRBLDGamiHfAbaA1S77jYdJSbqGSJ89sRDJQO2KFbS2ineVMGeMk4Oe1QPszlBPyzIpbt1i5%2FahbYONkTa4icaXBVSU7vwtnJTSU7NnuZ%2FON7iD7HnVA%3D\"}]}\r\ncf-ray: a1f19638ec535a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 8926\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8926,"size_decoded":9877,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 156x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9e410da38a58d8fde263a10181fe2394","sha1":"c90d16af2cda93c1097b6499a210efd3987ee907","sha256":"54cc70da78c5e8eedf9a0cf56a7c00b80c47eea2e4077898a0d4b14760332d82","sha512":"a8b889cbd09916e64e3833d2455056d73d7d169cbfc1e71c2a3008464241872d3aa31c0c21e4be773690ca7a4ce9d9702162757e5bcd73c6d75139efe1a43a82","ssdeep":"192:ZsXUjKAa9jixaZxzwPe5ZGcWG6YaupOgNv2NuKu6H2CnPsrhcYs:iXUjKt9+sZJwPDcHpagOgNeNuKuo2CPr","tlshash":"fc02b04c0191a9519bcd60d2b0ed14ab682c61e7f9c1648fb743776c50c3a04fac83fa","first_seen":"2026-07-22T09:56:21.355899Z","last_seen":"2026-07-22T09:58:55.775722Z","times_seen":2,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rain-bet.xyz/","fqdn":"rain-bet.xyz","domain":"rain-bet.xyz","tld":"xyz"},"ip":{"addr":"104.21.45.54","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-22T09:58:24.433Z","timestamp":1784714304433,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rain-bet.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 12:47:25 GMT","end":"Sat, 03 Oct 2026 12:47:24 GMT"},"fingerprint":{"sha1":"D2:6B:AB:AE:19:14:0C:D1:53:EB:8A:D9:48:EB:36:9A:22:7B:99:4B","sha256":"7C:41:16:C7:9E:DC:9B:3C:23:37:71:B3:32:A5:AA:74:95:A5:B8:7B:CF:E3:DB:6C:37:BD:D8:39:38:EF:FA:E8"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rain-bet.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 09:58:24 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nset-cookie: http-cookie=1784714305.699.10093.526882|882e00fa803f76adb4fe2898d9436430; Expires=Fri, 24-Jul-26 09:58:24 GMT; Max-Age=172800; Path=/; Secure; HttpOnly\r\ncache-control: no-cache, private\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: blob: https:; font-src 'self' data: https:; connect-src 'self' https: wss:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:;\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), fullscreen=(self)\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncontent-encoding: zstd\r\npriority: u=0,i\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yNpDrbuuMwC%2Finwe0pAEz3zAn4MGnz%2F9akSHfnXh7dGqd4CGzhq2kDKoW%2FL7CQKrGGzoTvoKKty%2FE%2FaYNBjglJf5BuvHOYk7kUOK3SwjUQnnfhp6UnriljESMw%2F3LlY%3D\"}]}\r\ncf-ray: a1f19632db3e5a0f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":713741,"size_decoded":69556,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (62802)","md5":"88655fd28812531117c6c67db80cf797","sha1":"380d49dd97446336625ae2dc752ccc8a45f1b3d8","sha256":"6e4cac1a7fbc05db30c88cb063c10d9e41a471aa280761094f46cf0654a3b8f8","sha512":"c341884e6ab6a95b9e7e8025fd46bc0280e3e9dc7d2ca7b8de5bd2b5a25e5aead6bfc6be7f011a5bdbdc3c492e3b58a25a51b48dea2f092baf6c92877aeda053","ssdeep":"3072:TmQedYY2TTKHkjDiI+kItqmyI7I7q7z7O7h7E7H757P7O:jXmyaaIn8BWbpzO","tlshash":"1ce429f145e895796853e3e3e210356aa629b8afa91b4dc0f75c478ccf83ec25c2395c","first_seen":"2026-07-22T09:58:55.776472Z","last_seen":"2026-07-22T09:58:55.776472Z","times_seen":1,"resource_available":true,"data":null}},"time_used":612,"timings":{"blocked":0,"dns":3,"connect":17,"send":0,"wait":345,"receive":247,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"rain-bet.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}