{"report_id":"f7809dca-78d7-4ea9-9d88-b0bdd3679984","version":0,"status":"done","tags":[],"date":"2026-07-17T09:14:54Z","url":{"schema":"http","addr":"rainbet-canada.win","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"rainbet-canada.win/","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"title":"Rainbet | Login, Enjoy Up To С$2300 In Deposit Bonus","dom":{"size":57535,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (53536)","md5":"1373865205ca1b8cdedb6f85f3ba9dbc","sha1":"3daae499549c2d70084c8b56ba59cf7eb1301d83","sha256":"4b2e726bea3386c5f4208387c92d979ebf51d23429a799fc1c5383e66e5e1131","sha512":"f2b0c77870ddeb2ddf87af1a3f8fdfdbe8557cde78c6e01bc3a7a9acb84b5c28814a2cfcfe24b62560755167f42a42a0e7cac8b7fbe49dd5c9e114340b316579","ssdeep":"768:Mm44u44HcVrfGYDRmTmr2tjYGCAavUYmCxR8Z1FHYI2xB9:r44u44HmOsowyxNa8tcWh4nj","tlshash":"f943e975828ce67f148793b8eb36db56b3afa055e925031586fdc39c2e86dc0dd27088","dom_hash":"domhash716a224dae198ecdb4273669b1bf2ad9","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rainbet-canada.win","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-21T09:14:54Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"rainbet-canada.win","ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-08-15","domain_rank":0,"first_seen":"2026-07-16T11:09:56.947294Z","last_seen":"2026-07-16T11:09:56.947294Z","alert_count":28,"request_count":14,"received_data":292615,"sent_data":9175,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP:7.4.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rainbet-canada.win/templates/rainbet-canada/js/index.js","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b04b5ce1594dccebfdbd6f5d668ed82e","sha1":"7415d7be1def6764cb358b4b85c4225be8e31ad2","sha256":"17d22406e07f0969f95ea6fccf6d7a4cc3f64e3340352089743ff7fbdb3e865c","sha512":"d8ea57d206eba4c13d89e92cc57ae863c13f009ea84fedeebff13211299134e5bbbad79087277f74f321d657e63542f58efec1e1f14a2d64c4cd885026d53b16","ssdeep":"96:YZLjD1+w+lBUYgLzrbmfHfsJ8A6n7nCnOpi+5/0mFD+Hs3:lwvzfIkZ2SN6Ss3","tlshash":"acc134312ec02a7533db1fab671319c0d461545fbac184cbe11cce687e8ad25eae2d75","size":5720,"data":"","first_seen":"2026-07-16T11:10:00.82773Z","last_seen":"2026-07-17T09:14:55.236158Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rainbet-canada.win/templates/rainbet-canada/img/general-banners/banner_1600_3.webp","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbet-canada.win/","date":"2026-07-17T09:14:27.955Z","timestamp":1784279667955,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbet-canada.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 04:09:25 GMT","end":"Sat, 05 Sep 2026 05:06:57 GMT"},"fingerprint":{"sha1":"FB:4D:94:43:B2:89:FE:02:F9:A9:3A:50:56:05:C7:A3:68:CF:03:A0","sha256":"DC:A7:D5:2E:39:1B:24:F7:C5:3F:CF:68:7E:22:87:A0:44:C9:7F:84:C3:A7:8E:D8:1A:54:C2:3F:2D:F4:1B:2C"}}},"request":{"raw":"GET /templates/rainbet-canada/img/general-banners/banner_1600_3.webp HTTP/1.1\r\nHost: rainbet-canada.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbet-canada.win/\r\nCookie: PHPSESSID=4314f87702ea9bbb7c675a3878155bf3; aXBwXzE5NS42NC4xMTguMTUy=none; aXBwXzEzOC4xMjQuNTMuNTU=none; cmFpbmJ_originn=bookm\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 17 Jul 2026 09:14:27 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 18 Aug 2025 10:47:24 GMT\r\npriority: u=5,i\r\netag: \"68a304bc-ab7c\"\r\nexpires: Fri, 16 Jul 2027 11:09:27 GMT\r\ncache-control: max-age=31536000\r\naccept-ranges: bytes\r\nage: 79499\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c7PAdWC8NhpV%2B2FlRxd6RrLX6LzXgBBCt3iwhGgJsFMqN6XMXOuU1IWcrvM%2B5WPSj0WjTVtQGmFmcR%2FWdYAhTdye4eD9z0iV3lgPLkXvQDppBzCws0an9MbzT%2Bweb%2FjrBgKAK6g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1c822f4ba07b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 43900\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43900,"size_decoded":44652,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6b6865c6d6ca42cbd3c43c8ff1ae3d66","sha1":"0bb77fec0f011116d17c5ada95ee13d8cf8588e4","sha256":"1bff6ea01281773759066f7a587dfe93e6293298f15e6649b586a063467172ed","sha512":"60846ecb63f16e4c516bbce6e79ad246c1291af4edd1d10b011688fdf064dcf37ba230f364c245223c1b3e6a6a34a45bc1d14a470440669ab34951b21900313b","ssdeep":"768:FwLUC/kBYfeV7N85Qfgigvdd5z7LFGbagDSr8ehCqkx4VowDNxXGtt6MG1jOH9q8:SLDfiE8Rgv5vFGFSr8ehCbx4VHNlGt4Q","tlshash":"271302ae6d58094defc0ff3c9a292b4ab101f968ff47ade6129d6c85309f241489f54c","first_seen":"2026-07-16T11:10:00.822997Z","last_seen":"2026-07-17T09:14:55.225136Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbet-canada.win/templates/rainbet-canada/img/review/stars-4.svg","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbet-canada.win/","date":"2026-07-17T09:14:27.958Z","timestamp":1784279667958,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbet-canada.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 04:09:25 GMT","end":"Sat, 05 Sep 2026 05:06:57 GMT"},"fingerprint":{"sha1":"FB:4D:94:43:B2:89:FE:02:F9:A9:3A:50:56:05:C7:A3:68:CF:03:A0","sha256":"DC:A7:D5:2E:39:1B:24:F7:C5:3F:CF:68:7E:22:87:A0:44:C9:7F:84:C3:A7:8E:D8:1A:54:C2:3F:2D:F4:1B:2C"}}},"request":{"raw":"GET /templates/rainbet-canada/img/review/stars-4.svg HTTP/1.1\r\nHost: rainbet-canada.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbet-canada.win/\r\nCookie: PHPSESSID=4314f87702ea9bbb7c675a3878155bf3; aXBwXzE5NS42NC4xMTguMTUy=none; aXBwXzEzOC4xMjQuNTMuNTU=none; cmFpbmJ_originn=bookm\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 17 Jul 2026 09:14:27 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Mon, 18 Aug 2025 10:47:22 GMT\r\nvary: accept-encoding\r\npriority: u=5,i\r\netag: W/\"68a304ba-88b\"\r\nexpires: Fri, 16 Jul 2027 11:09:27 GMT\r\ncache-control: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 79499\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M3DUM5ZibT1wr8bwmVGyL9f8Rzyppw56db1EMXT4A81HLGxYrsMzJX3v3SzGbV5HO3oe5O8WFx38LbZen%2FqJBP3b1tT%2FCMxXB2rYVNYuGIVZXJkMusZSEkpaj2IxBtTSoS5EWYg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1c822f4ba09b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2187,"size_decoded":1460,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"582db54dcd400136fbc8345077b78609","sha1":"28b4dfa65a97f9a250ab72955b67e4131380b433","sha256":"398c0e28764cf5be5e8ddd1fcb8d14c889fc260e2a7028a3863bdf3b025a5fb4","sha512":"56b30b5e81dad2695c469440149bf3afcbf3f878687ef6ff749ea425cc11e8736976207ac8b884cfd07a6fb7e354592fe1f120171dd54ea3d0d078f5360b9922","ssdeep":"","tlshash":"24418baae1e6906f6d57332dc2a85043dc3650dd1692c23cf98d553be72f09609f326e","first_seen":"2025-08-04T07:32:41.116624Z","last_seen":"2026-07-17T09:14:55.226489Z","times_seen":88,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbet-canada.win/templates/rainbet-canada/img/favicons/favicon16.png","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbet-canada.win/","date":"2026-07-17T09:14:28.041Z","timestamp":1784279668041,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbet-canada.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 04:09:25 GMT","end":"Sat, 05 Sep 2026 05:06:57 GMT"},"fingerprint":{"sha1":"FB:4D:94:43:B2:89:FE:02:F9:A9:3A:50:56:05:C7:A3:68:CF:03:A0","sha256":"DC:A7:D5:2E:39:1B:24:F7:C5:3F:CF:68:7E:22:87:A0:44:C9:7F:84:C3:A7:8E:D8:1A:54:C2:3F:2D:F4:1B:2C"}}},"request":{"raw":"GET /templates/rainbet-canada/img/favicons/favicon16.png HTTP/1.1\r\nHost: rainbet-canada.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbet-canada.win/\r\nCookie: PHPSESSID=4314f87702ea9bbb7c675a3878155bf3; aXBwXzE5NS42NC4xMTguMTUy=none; aXBwXzEzOC4xMjQuNTMuNTU=none; cmFpbmJ_originn=bookm\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 17 Jul 2026 09:14:28 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 18 Aug 2025 10:47:22 GMT\r\npriority: u=6,i=?0\r\netag: \"68a304ba-1ba\"\r\nexpires: Fri, 16 Jul 2027 11:09:28 GMT\r\ncache-control: max-age=31536000\r\naccept-ranges: bytes\r\nage: 79499\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=57w37%2FTa8HU6tY7FkBPqH0BQ5D3uO3K%2BBob7uFg1jV5DEMmSSdnJqwTyaFqKZOyqBNogVGV0Z8WQp3ZPpOdYUAqnb9EiI%2FUuh541uwnenj9UEw05iD%2B3JUeu8Owxm%2BHl0Dzwv9A%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1c822f54a13b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 442\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":442,"size_decoded":1193,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"0eaa6b0fc481a0b3b44c817ed6a81fed","sha1":"92575bf68309b6ac00ea59c682874282c4c3dad4","sha256":"b4331c1d3569aece0221c6826ea1b4c56deade1e5e6f399de19a6083a77f52fc","sha512":"4111220235bbecdb03c25355da6da96c8df606f9fb4e762a76ee1fe7c8dbb6a27139325dc26a9e83eb12053deb7604aada2f828936e37294d2cb47b8ae14bef7","ssdeep":"","tlshash":"14f023bb1276acb8c996a3bb48077c482f590251c0d2a504282732f6ad381592cdb499","first_seen":"2026-07-16T11:10:00.818729Z","last_seen":"2026-07-17T09:14:55.227312Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbet-canada.win/templates/rainbet-canada/footer-svg.txt","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://rainbet-canada.win/","date":"2026-07-17T09:14:28.044Z","timestamp":1784279668044,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbet-canada.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 04:09:25 GMT","end":"Sat, 05 Sep 2026 05:06:57 GMT"},"fingerprint":{"sha1":"FB:4D:94:43:B2:89:FE:02:F9:A9:3A:50:56:05:C7:A3:68:CF:03:A0","sha256":"DC:A7:D5:2E:39:1B:24:F7:C5:3F:CF:68:7E:22:87:A0:44:C9:7F:84:C3:A7:8E:D8:1A:54:C2:3F:2D:F4:1B:2C"}}},"request":{"raw":"GET /templates/rainbet-canada/footer-svg.txt HTTP/1.1\r\nHost: rainbet-canada.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rainbet-canada.win/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=4314f87702ea9bbb7c675a3878155bf3; aXBwXzE5NS42NC4xMTguMTUy=none; aXBwXzEzOC4xMjQuNTMuNTU=none; cmFpbmJ_originn=bookm\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 17 Jul 2026 09:14:28 GMT\r\ncontent-type: text/plain\r\nserver-timing: cfExtPri\r\npriority: u=4,i=?0\r\nlast-modified: Mon, 18 Aug 2025 10:47:22 GMT\r\netag: \"1ea2-63ca176e1d2b2-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5tvTAryULX3GbKoAo1fWRhgsIasD6CT8u%2BuwGMvNuPhY7tTCEfKmqo77WwoR%2FWulr4TU1iRS6UupQoyeg3ae3HFLbkrwygFtjv0D1sfOH4%2Ff22%2FVt8FnjUx1ENqtm4VVCZW5yTY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1c822f54a14b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3210\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7842,"size_decoded":3938,"mime_type":"text/plain","magic":"SVG Scalable Vector Graphics image","md5":"0703446073fb5d3a42d907da59741580","sha1":"cac46c2a2cf9ac6f6253cbaa37aee13c55799e83","sha256":"11421ffbd66e3e6f72aaddce7e361fe248e9061e657a5c8b6501cbc315d7134c","sha512":"0d8952c1b2ff57200fafb198a71677317632722ea1c3421e2c1e9990e18749dba7399e8db3951c232e4419d0aadb2f3f7c19ec8fa65aebb3bf639d315f5934c3","ssdeep":"192:hWn85lFkcrQXzMXyIBm3zW8eCUnkZEL3UPrWnkng0fmJnLViY:8ilFkc+VITis3Qg0gnL9","tlshash":"6ef10169c394d3b4dd5ec3bcca31b8b4788f14be90f1e31896b58470b2629d8d19d8da","first_seen":"2025-08-04T07:32:41.122321Z","last_seen":"2026-07-17T09:14:55.22897Z","times_seen":79,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":76,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbet-canada.win/templates/rainbet-canada/css/main2.css","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbet-canada.win/","date":"2026-07-17T09:14:27.942Z","timestamp":1784279667942,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbet-canada.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 04:09:25 GMT","end":"Sat, 05 Sep 2026 05:06:57 GMT"},"fingerprint":{"sha1":"FB:4D:94:43:B2:89:FE:02:F9:A9:3A:50:56:05:C7:A3:68:CF:03:A0","sha256":"DC:A7:D5:2E:39:1B:24:F7:C5:3F:CF:68:7E:22:87:A0:44:C9:7F:84:C3:A7:8E:D8:1A:54:C2:3F:2D:F4:1B:2C"}}},"request":{"raw":"GET /templates/rainbet-canada/css/main2.css HTTP/1.1\r\nHost: rainbet-canada.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbet-canada.win/\r\nCookie: PHPSESSID=4314f87702ea9bbb7c675a3878155bf3; aXBwXzE5NS42NC4xMTguMTUy=none; aXBwXzEzOC4xMjQuNTMuNTU=none; cmFpbmJ_originn=bookm\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 17 Jul 2026 09:14:27 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 18 Aug 2025 10:47:24 GMT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\netag: W/\"68a304bc-a713\"\r\nexpires: Fri, 16 Jul 2027 11:09:27 GMT\r\ncache-control: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 79500\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lICYGHCKyiUPEJkomoeWdQCCtdZP4%2BoemDUFvYUwNql8DUAVZCtCDdTsw%2FtbpTHvLlbc6UgIwOnCqthgA0CdrHLQVGsXFZSsr1TYZzE5H9CCo00res%2FfXSlm1iC7A7CDiPAjA4g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1c822f4aa02b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42771,"size_decoded":8335,"mime_type":"text/css","magic":"ASCII text, with very long lines (42771), with no line terminators","md5":"baf54e824073c682bf0025c5f99dceea","sha1":"c0e8a30a7c5765c91805eef4a18a90b4abe12dd7","sha256":"e6939757eff77fb1a37934a18e27bf32b0560530944a9d8cdd2a2c347e7d1707","sha512":"232225b363cda85a14001f4f682250b43ddb0c203c4d13d606c11959be316d1474394eb80654b84ee5f56087b1ec2ecc2dad76d5044ae408600758c73263382e","ssdeep":"384:3CTjSI691PlRYu4cD0ctY80kkaOthJVZyz98XazokMzm9n9x9C9Q9S9VgDRIkCml:MS9lmcD0cWFTXthJmGaJIkyk3/v","tlshash":"4f13967f6610715c9423cb2a37ea468d0278d029d22611ede9737a35cfcb3960663adf","first_seen":"2026-07-16T11:10:00.820753Z","last_seen":"2026-07-17T09:14:55.229535Z","times_seen":2,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbet-canada.win/templates/rainbet-canada/img/general-category/logo.webp","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbet-canada.win/","date":"2026-07-17T09:14:27.950Z","timestamp":1784279667950,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbet-canada.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 04:09:25 GMT","end":"Sat, 05 Sep 2026 05:06:57 GMT"},"fingerprint":{"sha1":"FB:4D:94:43:B2:89:FE:02:F9:A9:3A:50:56:05:C7:A3:68:CF:03:A0","sha256":"DC:A7:D5:2E:39:1B:24:F7:C5:3F:CF:68:7E:22:87:A0:44:C9:7F:84:C3:A7:8E:D8:1A:54:C2:3F:2D:F4:1B:2C"}}},"request":{"raw":"GET /templates/rainbet-canada/img/general-category/logo.webp HTTP/1.1\r\nHost: rainbet-canada.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbet-canada.win/\r\nCookie: PHPSESSID=4314f87702ea9bbb7c675a3878155bf3; aXBwXzE5NS42NC4xMTguMTUy=none; aXBwXzEzOC4xMjQuNTMuNTU=none; cmFpbmJ_originn=bookm\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 17 Jul 2026 09:14:27 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 18 Aug 2025 10:47:23 GMT\r\npriority: u=5,i\r\netag: \"68a304bb-28f6\"\r\nexpires: Fri, 16 Jul 2027 11:09:27 GMT\r\ncache-control: max-age=31536000\r\naccept-ranges: bytes\r\nage: 79499\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6HI%2BQH4Es9pTQpAAK3rrpnRUQkw6mL3tZKD26o6qlnEaEZx2gfPA1qIbIC3VTOwbUqihyPeBXZGCPGRVA2OEr8uSE1usHdu0wNOIpeck5efm9Q%2Bx05WYZ5HLzuR%2FIwTB2qQi04Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1c822f4ba04b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 10486\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10486,"size_decoded":11234,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"55f41d563b907c7697d8b6293168f5fa","sha1":"964e3c646ff5df0695741409eb04eab63fce1891","sha256":"ff70a9615639559e6f2bd291b73fb4ca45a070ce9224acc8a073bf824f2eecd0","sha512":"147df13dbfea41312d849d870c7f90c7bf5d39f14b8024af6ed8baa333be3c222a5ebbae80d38d232d2d72e4e36e3433b1598d7224f28b839a2972fb9a1dc60a","ssdeep":"192:F4EmmOF1+A3xFW1j3SqWVCSr8fnAvzVIrTHxOLT9EV3h/LNwlj8vY9f9dG41:F4EmxpMwCSr8f0V0HxOLT9EZ1Lyf+41","tlshash":"9b22c02c00f73a6213e409c021fa3363b2a1397989bb7dc440ace7e6540755bb2905bf","first_seen":"2026-07-16T11:10:00.828818Z","last_seen":"2026-07-17T09:14:55.230503Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbet-canada.win/templates/rainbet-canada/img/general-banners/banner_1600.webp","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbet-canada.win/","date":"2026-07-17T09:14:27.952Z","timestamp":1784279667952,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbet-canada.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 04:09:25 GMT","end":"Sat, 05 Sep 2026 05:06:57 GMT"},"fingerprint":{"sha1":"FB:4D:94:43:B2:89:FE:02:F9:A9:3A:50:56:05:C7:A3:68:CF:03:A0","sha256":"DC:A7:D5:2E:39:1B:24:F7:C5:3F:CF:68:7E:22:87:A0:44:C9:7F:84:C3:A7:8E:D8:1A:54:C2:3F:2D:F4:1B:2C"}}},"request":{"raw":"GET /templates/rainbet-canada/img/general-banners/banner_1600.webp HTTP/1.1\r\nHost: rainbet-canada.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbet-canada.win/\r\nCookie: PHPSESSID=4314f87702ea9bbb7c675a3878155bf3; aXBwXzE5NS42NC4xMTguMTUy=none; aXBwXzEzOC4xMjQuNTMuNTU=none; cmFpbmJ_originn=bookm\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 17 Jul 2026 09:14:27 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 18 Aug 2025 10:47:23 GMT\r\npriority: u=5,i\r\netag: \"68a304bb-6de0\"\r\nexpires: Fri, 16 Jul 2027 11:09:27 GMT\r\ncache-control: max-age=31536000\r\naccept-ranges: bytes\r\nage: 79499\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IITzEbPl6Pcpv7Bg3IMa5X8j26Jhmw%2Bt9rIh%2FeQxeFnYU%2Bbi49xoyutvw6mJjP1gkQa9B1R%2BeFD6NRRaJAKnIJnrFYydexlM%2Bxpeb1mZYE8ilxp%2Bc5FJahHVxfWptWKjkNzB8JI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1c822f4ba05b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 28128\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28128,"size_decoded":28882,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"519715cffa1e38bb60ba99c2b6583b11","sha1":"815756f52875bea23623fa11104ba159a14e7b29","sha256":"27f07144c230070faea5549faff8e48eb7fa2223909d438748f80323a4951bd5","sha512":"4ae17213507b7c1692810046ea145047db1bd1f8ec8866f55448efebe0a1a0cff14ef2c66516ec564fcc256a12c427cdfd1793df7a4d57d62c716f945c308383","ssdeep":"768:0h+ebt/hpKoAYHlcL+P8Tf16oOSh65o0pvtyGKiAW/r:vebzpKoAQpUd6oOSIo0poiFr","tlshash":"8cc2f111b6998b48d2d337f133e0164aa97e4b81bd8cd36b2be8732a251994c1d8b9c0","first_seen":"2026-07-16T11:10:00.830176Z","last_seen":"2026-07-17T09:14:55.231438Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbet-canada.win/templates/rainbet-canada/img/review/stars-5.svg","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbet-canada.win/","date":"2026-07-17T09:14:27.957Z","timestamp":1784279667957,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbet-canada.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 04:09:25 GMT","end":"Sat, 05 Sep 2026 05:06:57 GMT"},"fingerprint":{"sha1":"FB:4D:94:43:B2:89:FE:02:F9:A9:3A:50:56:05:C7:A3:68:CF:03:A0","sha256":"DC:A7:D5:2E:39:1B:24:F7:C5:3F:CF:68:7E:22:87:A0:44:C9:7F:84:C3:A7:8E:D8:1A:54:C2:3F:2D:F4:1B:2C"}}},"request":{"raw":"GET /templates/rainbet-canada/img/review/stars-5.svg HTTP/1.1\r\nHost: rainbet-canada.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbet-canada.win/\r\nCookie: PHPSESSID=4314f87702ea9bbb7c675a3878155bf3; aXBwXzE5NS42NC4xMTguMTUy=none; aXBwXzEzOC4xMjQuNTMuNTU=none; cmFpbmJ_originn=bookm\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 17 Jul 2026 09:14:27 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Mon, 18 Aug 2025 10:47:22 GMT\r\nvary: accept-encoding\r\npriority: u=5,i\r\netag: W/\"68a304ba-88b\"\r\nexpires: Fri, 16 Jul 2027 11:09:27 GMT\r\ncache-control: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 79500\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cYTOygvalzKo7OrCucmg7%2BVbHgTgy0n4m03SvGPutwCGxMBKirxE2fLJil2Hs0J9jy8hmWjV%2B2XkKDRwaeE9q7WgeE8L8rQ%2FmqLneeJgJBg04BidQCF01EoRy5odcW1aNNND3a8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1c822f4ba08b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2187,"size_decoded":1454,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ca40f3d9be2961ccb9704226af4b58c2","sha1":"08ac26d7d568c8978b7e8e0e6a1b6b229bb6dad4","sha256":"01b11512b9ea1110b45b50557340c88419d5bc3e239411b9b22041e810a979df","sha512":"eff47f03ac8418aabc0aaf0859b6f45cd80d4cbce43be0dd24463f95c09a6be0626dba5e8a51ca4e2a5f93f14f6339340ccb3a5d0c972d69258abe1d5f32bb2f","ssdeep":"","tlshash":"3b415999e0e6906b6d67336dd1a85043ec3650d91a92833cf98d513be71f09609f326e","first_seen":"2025-08-04T07:32:41.104214Z","last_seen":"2026-07-17T09:14:55.232328Z","times_seen":93,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbet-canada.win/templates/rainbet-canada/img/review/stars-3.svg","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbet-canada.win/","date":"2026-07-17T09:14:27.960Z","timestamp":1784279667960,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbet-canada.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 04:09:25 GMT","end":"Sat, 05 Sep 2026 05:06:57 GMT"},"fingerprint":{"sha1":"FB:4D:94:43:B2:89:FE:02:F9:A9:3A:50:56:05:C7:A3:68:CF:03:A0","sha256":"DC:A7:D5:2E:39:1B:24:F7:C5:3F:CF:68:7E:22:87:A0:44:C9:7F:84:C3:A7:8E:D8:1A:54:C2:3F:2D:F4:1B:2C"}}},"request":{"raw":"GET /templates/rainbet-canada/img/review/stars-3.svg HTTP/1.1\r\nHost: rainbet-canada.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbet-canada.win/\r\nCookie: PHPSESSID=4314f87702ea9bbb7c675a3878155bf3; aXBwXzE5NS42NC4xMTguMTUy=none; aXBwXzEzOC4xMjQuNTMuNTU=none; cmFpbmJ_originn=bookm\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 17 Jul 2026 09:14:27 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Mon, 18 Aug 2025 10:47:22 GMT\r\nvary: accept-encoding\r\npriority: u=5,i\r\netag: W/\"68a304ba-87a\"\r\nexpires: Fri, 16 Jul 2027 11:09:27 GMT\r\ncache-control: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 79500\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lYVropRLSrB3DVYJ%2FhUPj5GncAFlFb6tActHOniDffkNm6V20dgPnWD83qbo953umIZDJ%2B1jGDLHa87IIuig8HBYCJj%2FjSRBhdfYkshdjXxKZRnqTa57cVeWanA%2Fxc7nnOTtrq8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1c822f4ca0ab4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2170,"size_decoded":1455,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b450309b76b892c3bd61ec4a0f0ae783","sha1":"a6da1a37c4861a3822e53d1ecd7ce91e455c2118","sha256":"1c10e407615473c147935e87e5f1feab956e11b0e4f50454ef1cf64a24dcb9af","sha512":"0af81196eb5933a1b469c80041fb4498c3a2f6d2f07ca49489308ca9d4d0d5edec4a10d4f177c0e406351db8597abca93970fb2381dd165e189b7a9cf1063b74","ssdeep":"","tlshash":"51417599e1fa906f6c47332dc1a86047dc3650dd0692c23cf89d513ee70f09609f12ae","first_seen":"2024-11-04T07:00:00.462585Z","last_seen":"2026-07-17T09:14:55.232907Z","times_seen":204,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbet-canada.win/templates/rainbet-canada/img/favicons/favicon180.png","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rainbet-canada.win/","date":"2026-07-17T09:14:28.040Z","timestamp":1784279668040,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbet-canada.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 04:09:25 GMT","end":"Sat, 05 Sep 2026 05:06:57 GMT"},"fingerprint":{"sha1":"FB:4D:94:43:B2:89:FE:02:F9:A9:3A:50:56:05:C7:A3:68:CF:03:A0","sha256":"DC:A7:D5:2E:39:1B:24:F7:C5:3F:CF:68:7E:22:87:A0:44:C9:7F:84:C3:A7:8E:D8:1A:54:C2:3F:2D:F4:1B:2C"}}},"request":{"raw":"GET /templates/rainbet-canada/img/favicons/favicon180.png HTTP/1.1\r\nHost: rainbet-canada.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbet-canada.win/\r\nCookie: PHPSESSID=4314f87702ea9bbb7c675a3878155bf3; aXBwXzE5NS42NC4xMTguMTUy=none; aXBwXzEzOC4xMjQuNTMuNTU=none; cmFpbmJ_originn=bookm\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 17 Jul 2026 09:14:28 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 18 Aug 2025 10:47:23 GMT\r\npriority: u=6,i=?0\r\netag: \"68a304bb-45f6\"\r\nexpires: Fri, 16 Jul 2027 11:09:28 GMT\r\ncache-control: max-age=31536000\r\naccept-ranges: bytes\r\nage: 79499\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TDBj8Izvr1Bkl%2BLb3Erg0wqrQ7z6iqhzIVVZoiMdZ1x7nMREsI5a%2BT0awrpo84Hb0SWIluQpNjY5%2Bsp434KX6CJii7g6UPjR6k86pCeQpUtaJKSED3dIB8V9S61Up7VeO5iD3hE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1c822f54a12b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 17910\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17910,"size_decoded":18660,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"1f9f109458cf616a6ed73c37c67e6e50","sha1":"d171293c5c5cd7d47629660b96ed878a88d58cde","sha256":"5869312e0dad53cda9a5a01a9c5bd89021af2e59ed9fc7aa3f2881d16259d137","sha512":"85658808ab2a3ec1e047e842e0dcb7f0ba9f34acf370560071315314fdf0ce8c7e186e8e5f4a429f2969a12ea6547d625413a3fd670b8177fa26c1eaf74f92b9","ssdeep":"384:/l8i5xP5ZkXHonOfyXbvKyjXoPctstaO3eAlVcRuYn:ddBqonOfyXbv9jXS7ta0eAlVcb","tlshash":"5982c096a983e48535fff2ae75ac1f3ebe4fbdd4c3a44053522fe1093025819a160d69","first_seen":"2026-07-16T11:10:00.825714Z","last_seen":"2026-07-17T09:14:55.233399Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbet-canada.win/","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T09:14:27.181Z","timestamp":1784279667181,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbet-canada.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 04:09:25 GMT","end":"Sat, 05 Sep 2026 05:06:57 GMT"},"fingerprint":{"sha1":"FB:4D:94:43:B2:89:FE:02:F9:A9:3A:50:56:05:C7:A3:68:CF:03:A0","sha256":"DC:A7:D5:2E:39:1B:24:F7:C5:3F:CF:68:7E:22:87:A0:44:C9:7F:84:C3:A7:8E:D8:1A:54:C2:3F:2D:F4:1B:2C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rainbet-canada.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 17 Jul 2026 09:14:27 GMT\r\ncontent-type: text/html; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=0,i\r\nx-powered-by: PHP/7.4.33\r\nset-cookie: PHPSESSID=4314f87702ea9bbb7c675a3878155bf3; path=/\naXBwXzE5NS42NC4xMTguMTUy=none; expires=Fri, 10-Jun-2033 09:14:27 GMT; Max-Age=217728000\naXBwXzEzOC4xMjQuNTMuNTU=none; expires=Fri, 10-Jun-2033 09:14:27 GMT; Max-Age=217728000\ncmFpbmJ_originn=bookm; expires=Fri, 17-Jul-2026 10:14:27 GMT; Max-Age=3600\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6%2FChIMXFrqwk%2BiAR0OYdakHJWHIgcLGjyXUSgvA4MINw7Ktbk0sMoKKwd0YMyu354mdHQ0nvC%2BG2nstDTDbHF1Rwo6YE1eox6d%2FDEAcd90%2ByAV6PdUiRUZjLjeGcDDYN9B5p1GM%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a1c822f019c5b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:7.4.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49514,"size_decoded":10211,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (49479), with no line terminators","md5":"9b3c4d48ce00088b11c1c174f4aa501c","sha1":"f5f6e66d6b21f9c994fd93742ae8e130f452840e","sha256":"a0d8e2aa36c10eeccd30cdb60113264e7060fbe634dd3d5870865e100a7e9991","sha512":"82c73fca1c231091223ecb0e1c631de1f9f081f4c28f0cc5f08ac6c78b1c405003664b2d40e1ea42f9e458da3494fd24dd047782ddc29bd8b5ea1e59eaf1eac9","ssdeep":"768:sm44u44HcYuU5FERC4mYetjnGlAaeUxmZxRUZL:L44u44H4imr3aGua1g3mV","tlshash":"f423b976428cfa6f118793a8ab36cb56f3bea054ed16071146fec79d1e8bd81dd23048","first_seen":"2026-07-16T11:10:00.819786Z","last_seen":"2026-07-17T09:14:55.234247Z","times_seen":2,"resource_available":true,"data":null}},"time_used":556,"timings":{"blocked":-1,"dns":15,"connect":16,"send":0,"wait":524,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbet-canada.win/templates/rainbet-canada/css/color.css","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rainbet-canada.win/","date":"2026-07-17T09:14:27.936Z","timestamp":1784279667936,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbet-canada.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 04:09:25 GMT","end":"Sat, 05 Sep 2026 05:06:57 GMT"},"fingerprint":{"sha1":"FB:4D:94:43:B2:89:FE:02:F9:A9:3A:50:56:05:C7:A3:68:CF:03:A0","sha256":"DC:A7:D5:2E:39:1B:24:F7:C5:3F:CF:68:7E:22:87:A0:44:C9:7F:84:C3:A7:8E:D8:1A:54:C2:3F:2D:F4:1B:2C"}}},"request":{"raw":"GET /templates/rainbet-canada/css/color.css HTTP/1.1\r\nHost: rainbet-canada.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbet-canada.win/\r\nCookie: PHPSESSID=4314f87702ea9bbb7c675a3878155bf3; aXBwXzE5NS42NC4xMTguMTUy=none; aXBwXzEzOC4xMjQuNTMuNTU=none; cmFpbmJ_originn=bookm\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 17 Jul 2026 09:14:27 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 18 Aug 2025 10:47:24 GMT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\netag: W/\"68a304bc-262\"\r\nexpires: Fri, 16 Jul 2027 11:09:27 GMT\r\ncache-control: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 79499\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DDBYmr1xc24o8dKZ16d9R5qma3HVeUmsOGFRSB25ur2oY5Sf%2BetyRZNMkt7GHkmaCSjMaQuCW5Haib9KJbKI2kb9zOa372Vu9gCVkblWVfmI9IPWLp3R80KrS6IfJ5sHhhAFzO0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1c822f49a00b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":610,"size_decoded":1005,"mime_type":"text/css","magic":"ASCII text","md5":"a5e2a04bc931dcc32b4114a0d3b765f6","sha1":"f591bbcd8e7b6a4420190d54fd8445cdb56b0b53","sha256":"eba1479b03b3ce75366a169a02160c0ade88ce6a9b1de8d8141bf1d663855ca8","sha512":"9c917795eae9820ace4996c89f0d483b3d04f1e5a27b5fda3c146121715e078062343842c042121e59ce713125b4098bb55a61c91667d303f836c36fba1679ed","ssdeep":"","tlshash":"e4f06d43d76b2b1a51bb96ab73eb840f63f5221b2301fea873d516e10f0d0e894c3842","first_seen":"2026-07-16T11:10:00.826825Z","last_seen":"2026-07-17T09:14:55.2352Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbet-canada.win/templates/rainbet-canada/js/index.js","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rainbet-canada.win/","date":"2026-07-17T09:14:27.945Z","timestamp":1784279667945,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbet-canada.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 04:09:25 GMT","end":"Sat, 05 Sep 2026 05:06:57 GMT"},"fingerprint":{"sha1":"FB:4D:94:43:B2:89:FE:02:F9:A9:3A:50:56:05:C7:A3:68:CF:03:A0","sha256":"DC:A7:D5:2E:39:1B:24:F7:C5:3F:CF:68:7E:22:87:A0:44:C9:7F:84:C3:A7:8E:D8:1A:54:C2:3F:2D:F4:1B:2C"}}},"request":{"raw":"GET /templates/rainbet-canada/js/index.js HTTP/1.1\r\nHost: rainbet-canada.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbet-canada.win/\r\nCookie: PHPSESSID=4314f87702ea9bbb7c675a3878155bf3; aXBwXzE5NS42NC4xMTguMTUy=none; aXBwXzEzOC4xMjQuNTMuNTU=none; cmFpbmJ_originn=bookm\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 17 Jul 2026 09:14:27 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 18 Aug 2025 10:47:24 GMT\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\netag: W/\"68a304bc-1658\"\r\nexpires: Fri, 16 Jul 2027 11:09:27 GMT\r\ncache-control: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 79499\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MMVK4m2xV%2FWtAYGsB%2Be1AR%2FHXWFbvPxjUs0lqGoCyoyhDraVZol4AcRwid4f1KufEK6Tv7tIUii56HTmgKm22LmnFv%2FwIvsnvId7NIkB5md8N2pAIGb%2F3f77TdOZyh8htwQ%2FFTM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1c822f4aa03b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5720,"size_decoded":2797,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5720), with no line terminators","md5":"b04b5ce1594dccebfdbd6f5d668ed82e","sha1":"7415d7be1def6764cb358b4b85c4225be8e31ad2","sha256":"17d22406e07f0969f95ea6fccf6d7a4cc3f64e3340352089743ff7fbdb3e865c","sha512":"d8ea57d206eba4c13d89e92cc57ae863c13f009ea84fedeebff13211299134e5bbbad79087277f74f321d657e63542f58efec1e1f14a2d64c4cd885026d53b16","ssdeep":"96:YZLjD1+w+lBUYgLzrbmfHfsJ8A6n7nCnOpi+5/0mFD+Hs3:lwvzfIkZ2SN6Ss3","tlshash":"acc134312ec02a7533db1fab671319c0d461545fbac184cbe11cce687e8ad25eae2d75","first_seen":"2026-07-16T11:10:00.82773Z","last_seen":"2026-07-17T09:14:55.236158Z","times_seen":2,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rainbet-canada.win/templates/rainbet-canada/img/general-banners/banner_1600_2.webp","fqdn":"rainbet-canada.win","domain":"rainbet-canada.win","tld":"win"},"ip":{"addr":"172.67.219.57","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://rainbet-canada.win/","date":"2026-07-17T09:14:27.954Z","timestamp":1784279667954,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rainbet-canada.win","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 04:09:25 GMT","end":"Sat, 05 Sep 2026 05:06:57 GMT"},"fingerprint":{"sha1":"FB:4D:94:43:B2:89:FE:02:F9:A9:3A:50:56:05:C7:A3:68:CF:03:A0","sha256":"DC:A7:D5:2E:39:1B:24:F7:C5:3F:CF:68:7E:22:87:A0:44:C9:7F:84:C3:A7:8E:D8:1A:54:C2:3F:2D:F4:1B:2C"}}},"request":{"raw":"GET /templates/rainbet-canada/img/general-banners/banner_1600_2.webp HTTP/1.1\r\nHost: rainbet-canada.win\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://rainbet-canada.win/\r\nCookie: PHPSESSID=4314f87702ea9bbb7c675a3878155bf3; aXBwXzE5NS42NC4xMTguMTUy=none; aXBwXzEzOC4xMjQuNTMuNTU=none; cmFpbmJ_originn=bookm\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 17 Jul 2026 09:14:27 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 18 Aug 2025 10:47:23 GMT\r\npriority: u=5,i\r\netag: \"68a304bb-10948\"\r\nexpires: Fri, 16 Jul 2027 11:09:27 GMT\r\ncache-control: max-age=31536000\r\naccept-ranges: bytes\r\nage: 79499\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vwe9ikrLVLH4PupIMEMVRO40dASbZWLPVBgjYcqw7zjcTpmrXLJ1Ez5Xqu4T%2Fq%2BjFjAmZDbhXVK6haziEJettT9pKOmnnSoBv4qRlJEPNZp84c1Mwd7MVytNPdmAbq%2B1pmQR08U%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a1c822f4ba06b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 67912\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67912,"size_decoded":68661,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2c92c673a80a3dbf7616d077ea043d1b","sha1":"1815006d4aa0490a9a45a3a69fabce2d687e8a35","sha256":"b2ef05fe700b33a8917cd9f2d093c2774afe0d688c953146d6368c995166bfa2","sha512":"41047accc8b9c231667944084a7ed860dff75bba83fa6001769b887c91f573f0c251146c07779a43ffa0d49473a6391ff00efe95e548b037ef3fadeebd893de0","ssdeep":"1536:ZSBj1EvPMbuSdk/dVYHBT3u4F6GyDEYdxjYwm6JqW:gB2PMU/dKhTcJXgW","tlshash":"0863028e24279af4d5631678a637e76b4f092275bb834c0f4fc026ba931c4cf56d8970","first_seen":"2026-07-16T11:10:00.821916Z","last_seen":"2026-07-17T09:14:55.237505Z","times_seen":2,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"rainbet-canada.win","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}