{"report_id":"017e47f5-f428-4bfb-92b1-542035d03484","version":0,"status":"done","tags":[],"date":"2026-06-12T21:31:27Z","url":{"schema":"http","addr":"kra26at.cc/","fqdn":"kra26at.cc","domain":"kra26at.cc","tld":"cc"},"ip":{"addr":"178.20.210.39","port":0,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"captcha.zlon8.to/","fqdn":"captcha.zlon8.to","domain":"zlon8.to","tld":"to"},"title":"Captcha","dom":{"size":18505,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (16129)","md5":"8db1d6640769a598fcb27dfcf91e0ce8","sha1":"22a07e032be9557d545ce92758f687acd0f4f837","sha256":"e601cc1343e827df6f8644ec969a4529ca6af07026508b622207c20b89d86003","sha512":"199a70ba291285127cbb516732b27ef50c5f1b50d167c31b8de08d4777a9b75688f74e60edc3a0436f70b2319f2d591e681cd5c6fd1f410f0bb1c64ee55b8db2","ssdeep":"384:Cbntt/INqpfomyF8cTxwb8xb8Ce7nFxp9Ll+ToWT1LWn6euzSvnx/0:2/xomcZTxwb8G9NeoE1anySPx/0","tlshash":"1682b0e5f56296318dc1b0a5b8d5bf123c4e9037825a6388725cc4a19facbc401a7fae","dom_hash":"domhasha37bd804fdcecd19cc45a83abf9678f0","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"kra26at.cc/","fqdn":"kra26at.cc","domain":"kra26at.cc","tld":"cc"},"ip":{"addr":"178.20.210.39","port":0,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-17T21:31:27Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-12","alert":"Sinkholed","trigger":"kra26at.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-12","alert":"Sinkholed","trigger":"kra26at.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"kra26at.cc","ip":{"addr":"178.20.210.39","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"domain_registered":"2026-01-19","domain_rank":3018436,"first_seen":"2026-05-18T23:52:51.119173Z","last_seen":"2026-05-18T23:52:51.119173Z","alert_count":2,"request_count":1,"received_data":544,"sent_data":479,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"captcha.zlon8.to","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-05-26T17:40:18.689965Z","last_seen":"2026-06-12T10:06:31.93912Z","alert_count":0,"request_count":4,"received_data":25337,"sent_data":2978,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"zlon8.to","ip":{"addr":"178.20.210.39","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-05-26T17:40:18.69392Z","last_seen":"2026-06-12T10:06:31.993521Z","alert_count":0,"request_count":4,"received_data":2417,"sent_data":2599,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-06-07T22:22:03.23237Z","alert_count":0,"request_count":1,"received_data":10792,"sent_data":532,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"zlon8.to/","fqdn":"zlon8.to","domain":"zlon8.to","tld":"to"},"ip":{"addr":"178.20.210.39","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"a1edc37c8e3ac768dd33e2d4cb42cafe","sha1":"18a8b4436ac3a7c43c4e0a4b0447fa0a0c4326f1","sha256":"5e65b7779aa16aca85d3187a963ac1ecad9ce623c7df36c7fb315b00fcb2c6a9","sha512":"02b5bc7079232b511de90c8d5ac447721b96a1472138cf0e9de274ba3d895b52e4e781a05812ce8f32a30a3822c9240cc7fde176731d9a04a76cf7a3ac352e36","ssdeep":"","tlshash":"899002a359b1509b87265a14524671122b260971870e5717155a0a718574744e941b55","size":57,"data":"","first_seen":"2025-03-07T11:01:59.145819Z","last_seen":"2026-07-21T12:02:27.319183Z","times_seen":829,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zlon8.to/","fqdn":"zlon8.to","domain":"zlon8.to","tld":"to"},"ip":{"addr":"178.20.210.39","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"c2e5146c86321e5cb32a1bbbf6d94948","sha1":"8c4c52a59a82f72c8e75ee2e3ffa780eb08acc2e","sha256":"6d04d0502b0af51a0bd521653342661f3921165aaf99b889e8e1e91ea654d0f3","sha512":"78c7ddb0f2a4ebb46b7ea44f6e2bf5910e163022e4fbf0d87b35951e96ba53f762bc299b17d9882df5326e976a16b98b9590848592203f55c298f432c0d0e99d","ssdeep":"","tlshash":"8b90044541c77151c031157441dc5070413c50015c1dfc13310c4c310d4033f5d40311","size":46,"data":"","first_seen":"2026-06-07T12:22:38.17104Z","last_seen":"2026-07-21T12:02:27.319656Z","times_seen":89,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zlon8.to/js/connect.min.js?2","fqdn":"zlon8.to","domain":"zlon8.to","tld":"to"},"ip":{"addr":"178.20.210.39","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"ddc1c95b6ab9223711ed7f50a15bc930","sha1":"7d6cf05a1da4d78f98f5ceba3784a0bc210116a3","sha256":"9fa0fd5b129cc1062500cf31c6be66f6617d829c3e4ccf0dc7cdba46f992632e","sha512":"115c9699f4ef5c42484fe47b58b2e87dec9cf96515a2b6da929237e7d4f3b579f2f20b4c61b9795ca549d9b3f24f85ec5afcc18431e26c215108366f3491f4cc","ssdeep":"192:op2O/++sssVpvqUl87UlCUldUlQwV3drycp3FJQipv8DIk1FBHwKs/XsUCbl3Pii:o0O/++sss6UlyUlCUldUlBXp3PDN8Dhl","tlshash":"84329840eae4f855a613139da70bbbc4f10815aa30201f97a76c1d88f95e47be6b3d73","size":11274,"data":"","first_seen":"2023-05-03T10:33:12Z","last_seen":"2026-07-21T12:02:27.31767Z","times_seen":1044,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zlon8.to/","fqdn":"zlon8.to","domain":"zlon8.to","tld":"to"},"ip":{"addr":"178.20.210.39","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"a1edc37c8e3ac768dd33e2d4cb42cafe","sha1":"18a8b4436ac3a7c43c4e0a4b0447fa0a0c4326f1","sha256":"5e65b7779aa16aca85d3187a963ac1ecad9ce623c7df36c7fb315b00fcb2c6a9","sha512":"02b5bc7079232b511de90c8d5ac447721b96a1472138cf0e9de274ba3d895b52e4e781a05812ce8f32a30a3822c9240cc7fde176731d9a04a76cf7a3ac352e36","ssdeep":"","tlshash":"899002a359b1509b87265a14524671122b260971870e5717155a0a718574744e941b55","size":57,"data":"","first_seen":"2025-03-07T11:01:59.145819Z","last_seen":"2026-07-21T12:02:27.319183Z","times_seen":829,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zlon8.to/","fqdn":"zlon8.to","domain":"zlon8.to","tld":"to"},"ip":{"addr":"178.20.210.39","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"c2e5146c86321e5cb32a1bbbf6d94948","sha1":"8c4c52a59a82f72c8e75ee2e3ffa780eb08acc2e","sha256":"6d04d0502b0af51a0bd521653342661f3921165aaf99b889e8e1e91ea654d0f3","sha512":"78c7ddb0f2a4ebb46b7ea44f6e2bf5910e163022e4fbf0d87b35951e96ba53f762bc299b17d9882df5326e976a16b98b9590848592203f55c298f432c0d0e99d","ssdeep":"","tlshash":"8b90044541c77151c031157441dc5070413c50015c1dfc13310c4c310d4033f5d40311","size":46,"data":"","first_seen":"2026-06-07T12:22:38.17104Z","last_seen":"2026-07-21T12:02:27.319656Z","times_seen":89,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"captcha.zlon8.to/css/normalize.css","fqdn":"captcha.zlon8.to","domain":"zlon8.to","tld":"to"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://captcha.zlon8.to/","date":"2026-06-12T21:31:06.328Z","timestamp":1781299866328,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /css/normalize.css HTTP/1.1\r\nHost: captcha.zlon8.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://captcha.zlon8.to/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra26at.cc; session_id_e=513eb69cdb4ff9ca5b7a1c3fe1b23313; connecting_hash_lite_version=1781299864; session_temp_active=1; tor_scheme_id=1781356056; tor_port=9137; session_id=4b05a9e0b47fe6715f74473a7359c6f7; onion_server_id=4; remote_route=2; remote_server_id=csrv_13\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T02:24:28.635112Z","times_seen":17437918,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"captcha.zlon8.to/favicon.ico","fqdn":"captcha.zlon8.to","domain":"zlon8.to","tld":"to"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://captcha.zlon8.to/","date":"2026-06-12T21:31:08.734Z","timestamp":1781299868734,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: captcha.zlon8.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://captcha.zlon8.to/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra26at.cc; session_id_e=513eb69cdb4ff9ca5b7a1c3fe1b23313; connecting_hash_lite_version=1781299864; session_temp_active=1; tor_scheme_id=1781356056; tor_port=9137; session_id=4b05a9e0b47fe6715f74473a7359c6f7; onion_server_id=4; remote_route=2; remote_server_id=csrv_13\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T02:24:28.635112Z","times_seen":17437918,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zlon8.to/","fqdn":"zlon8.to","domain":"zlon8.to","tld":"to"},"ip":{"addr":"178.20.210.39","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-12T21:31:04.949Z","timestamp":1781299864949,"http_version":"HTTP/1.1","security_state":"secure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: zlon8.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra26at.cc\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 12 Jun 2026 21:31:04 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 495\r\nConnection: keep-alive\r\nSet-Cookie: tor_scheme_id=1781640725; expires=Sat, 12 Jun 2027 21:31:04 GMT; Max-Age=31536000; path=/\ntor_port=9335; expires=Sat, 12 Jun 2027 21:31:04 GMT; Max-Age=31536000; path=/\nsession_id=35f1d16ceebc4be2afb92b7fa088aecf; expires=Sat, 12 Jun 2027 21:31:04 GMT; Max-Age=31536000; path=/\nsession_id_e=513eb69cdb4ff9ca5b7a1c3fe1b23313; expires=Sat, 12 Jun 2027 21:31:04 GMT; Max-Age=31536000; path=/; domain=.zlon8.to\nconnecting_hash_lite_version=1781299864; expires=Sat, 12 Jun 2027 21:31:04 GMT; Max-Age=31536000; path=/; domain=.zlon8.to\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nStrict-Transport-Security: max-age=63072000\r\nServer: nginx, nginx\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nReferrer-Policy: strict-origin-when-cross-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T02:24:28.635112Z","times_seen":17437918,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zlon8.to/","fqdn":"zlon8.to","domain":"zlon8.to","tld":"to"},"ip":{"addr":"178.20.210.39","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-12T21:31:05.452Z","timestamp":1781299865452,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zlon8.to","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 10 Jun 2026 01:59:43 GMT","end":"Tue, 08 Sep 2026 01:59:42 GMT"},"fingerprint":{"sha1":"D0:EE:4F:69:38:44:D9:59:40:4E:2D:9F:C6:7D:0A:BB:5A:B4:EC:C6","sha256":"44:13:1A:FE:D0:00:6C:AE:D9:B0:78:42:D5:9B:CA:CB:50:FB:C9:3E:6F:A3:4E:33:15:EF:A8:5B:81:91:10:DB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: zlon8.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra26at.cc; tor_scheme_id=1781640725; tor_port=9335; session_id=35f1d16ceebc4be2afb92b7fa088aecf; session_id_e=513eb69cdb4ff9ca5b7a1c3fe1b23313; connecting_hash_lite_version=1781299864; connecting_hash=9181ed5d34494dce5a67b0ac3b4b32b7; onion_server_id=3\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nDate: Fri, 12 Jun 2026 21:31:05 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 0\r\nConnection: keep-alive\r\nSet-Cookie: proxy_cf_session_id=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/; domain=.zlon8.to\nsession_temp_active=1; expires=Fri, 12 Jun 2026 23:01:05 GMT; Max-Age=5400; path=/; domain=.zlon8.to\r\nLocation: /\r\nStrict-Transport-Security: max-age=63072000\r\nServer: nginx, nginx\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nReferrer-Policy: strict-origin-when-cross-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T02:24:28.635112Z","times_seen":17437918,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zlon8.to/","fqdn":"zlon8.to","domain":"zlon8.to","tld":"to"},"ip":{"addr":"178.20.210.39","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-12T21:31:05.477Z","timestamp":1781299865477,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zlon8.to","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 10 Jun 2026 01:59:43 GMT","end":"Tue, 08 Sep 2026 01:59:42 GMT"},"fingerprint":{"sha1":"D0:EE:4F:69:38:44:D9:59:40:4E:2D:9F:C6:7D:0A:BB:5A:B4:EC:C6","sha256":"44:13:1A:FE:D0:00:6C:AE:D9:B0:78:42:D5:9B:CA:CB:50:FB:C9:3E:6F:A3:4E:33:15:EF:A8:5B:81:91:10:DB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: zlon8.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra26at.cc; tor_scheme_id=1781640725; tor_port=9335; session_id=35f1d16ceebc4be2afb92b7fa088aecf; session_id_e=513eb69cdb4ff9ca5b7a1c3fe1b23313; connecting_hash_lite_version=1781299864; connecting_hash=9181ed5d34494dce5a67b0ac3b4b32b7; onion_server_id=3; session_temp_active=1\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nDate: Fri, 12 Jun 2026 21:31:05 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 0\r\nConnection: keep-alive\r\nLocation: https://captcha.zlon8.to\r\nStrict-Transport-Security: max-age=63072000\r\nServer: nginx, nginx\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nReferrer-Policy: strict-origin-when-cross-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T02:24:28.635112Z","times_seen":17437918,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"captcha.zlon8.to/","fqdn":"captcha.zlon8.to","domain":"zlon8.to","tld":"to"},"ip":{"addr":"178.20.210.35","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-12T21:31:05.526Z","timestamp":1781299865526,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zlon8.to","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 10 Jun 2026 01:59:43 GMT","end":"Tue, 08 Sep 2026 01:59:42 GMT"},"fingerprint":{"sha1":"D0:EE:4F:69:38:44:D9:59:40:4E:2D:9F:C6:7D:0A:BB:5A:B4:EC:C6","sha256":"44:13:1A:FE:D0:00:6C:AE:D9:B0:78:42:D5:9B:CA:CB:50:FB:C9:3E:6F:A3:4E:33:15:EF:A8:5B:81:91:10:DB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: captcha.zlon8.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra26at.cc; session_id_e=513eb69cdb4ff9ca5b7a1c3fe1b23313; connecting_hash_lite_version=1781299864; session_temp_active=1\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 12 Jun 2026 21:31:06 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 15227\r\nConnection: keep-alive\r\nSet-Cookie: tor_scheme_id=1781356056; expires=Sat, 12 Jun 2027 21:31:05 GMT; Max-Age=31536000; path=/\ntor_port=9137; expires=Sat, 12 Jun 2027 21:31:05 GMT; Max-Age=31536000; path=/\nsession_id=4b05a9e0b47fe6715f74473a7359c6f7; expires=Sat, 12 Jun 2027 21:31:05 GMT; Max-Age=31536000; path=/\nonion_server_id=4; expires=Sat, 12 Jun 2027 21:31:05 GMT; Max-Age=31536000; path=/\nremote_route=2; path=/\nremote_server_id=csrv_13; path=/; domain=.zlon8.to\nremote_user_id=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/; domain=.zlon8.to\nrefresh_page_error_count=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/; domain=.zlon8.to\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nStrict-Transport-Security: max-age=63072000\r\nServer: nginx, nginx\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nReferrer-Policy: strict-origin-when-cross-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24279,"size_decoded":16285,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (16130), with CRLF, LF line terminators","md5":"b1c45e8fc11880ea73ba70f4c2cc0f79","sha1":"7e35c848e8a2033728f5a42f07fb42ecbd0e2e19","sha256":"6473f6807f3e9c6368ae5b1899d3dfdce77ef5b4c8d95f89bc36cba36f40e1bd","sha512":"21bba76850a55777a604f35d151a1039544b883196b782862647081daa895317a702efa210d6ec5bdb2bb83eebb2c084e90ac9c237d36af970350c446dc9684f","ssdeep":"384:8+ntt/INqpfomyF8cTxwb8xb8Ce7nFxp9Ll+ToWT1LWn6euE8vnx/elqZFc:9/xomcZTxwb8G9NeoE1anr8Px/elqZFc","tlshash":"62b29f9ba92755215d92f074bfeaeb027c1e40278206d6487b4c85a4cfb9bc401b3fed","first_seen":"2026-06-12T21:31:28.406371Z","last_seen":"2026-06-12T21:31:28.406371Z","times_seen":1,"resource_available":true,"data":null}},"time_used":560,"timings":{"blocked":0,"dns":47,"connect":14,"send":0,"wait":469,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@300;400;500;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://captcha.zlon8.to/","date":"2026-06-12T21:31:06.323Z","timestamp":1781299866323,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 25 May 2026 08:38:19 GMT","end":"Mon, 17 Aug 2026 08:38:18 GMT"},"fingerprint":{"sha1":"4D:E0:8E:62:2F:B2:3D:28:5D:7D:B5:8D:C5:3A:72:E4:EE:AB:7D:93","sha256":"AE:0B:4F:B5:B7:41:E5:0C:70:C0:E1:2A:F9:DB:AD:A8:64:94:F3:70:6D:38:1C:8A:8A:CA:52:96:5C:D8:5C:87"}}},"request":{"raw":"GET /css2?family=Inter:wght@300;400;500;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://captcha.zlon8.to/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 12 Jun 2026 21:31:21 GMT\r\ndate: Fri, 12 Jun 2026 21:31:21 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10108,"size_decoded":1446,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"1be305145d51ecbeb52ba67f2208dea9","sha1":"6f97fc00e9d6771004cb17d53c7ff7d62011e78e","sha256":"5fb68a19bfedc1331144c73515b5cc021af26ac8605c62e73a31771a0e19ee62","sha512":"b3a73238231bbeeaf01907f0e3a78d4221d24b50de71345c66a6d6a4ff6afb5fd8d88b242a57ba35d37f0466edc6d3a19c7e02dfd4563d2ee565ca2cc06182c6","ssdeep":"192:wNA1cO3lnxirNNIxO34OxDENOPCO3/Nx8ONEhYO3RrxGx:8KYXuM1+4","tlshash":"dd227792002ba400ab971dc233cf7f3aaece10896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-11T03:25:11.707221Z","last_seen":"2026-07-21T20:01:41.144498Z","times_seen":3969,"resource_available":false,"data":null}},"time_used":15663,"timings":{"blocked":-1,"dns":0,"connect":15577,"send":0,"wait":36,"receive":0,"ssl":50},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"captcha.zlon8.to/js/connect.min.js?2","fqdn":"captcha.zlon8.to","domain":"zlon8.to","tld":"to"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://captcha.zlon8.to/","date":"2026-06-12T21:31:06.331Z","timestamp":1781299866331,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /js/connect.min.js?2 HTTP/1.1\r\nHost: captcha.zlon8.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://captcha.zlon8.to/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: http_refererq2=https%3A%2F%2Fkra26at.cc; session_id_e=513eb69cdb4ff9ca5b7a1c3fe1b23313; connecting_hash_lite_version=1781299864; session_temp_active=1; tor_scheme_id=1781356056; tor_port=9137; session_id=4b05a9e0b47fe6715f74473a7359c6f7; onion_server_id=4; remote_route=2; remote_server_id=csrv_13\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T02:24:28.635112Z","times_seen":17437918,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kra26at.cc/","fqdn":"kra26at.cc","domain":"kra26at.cc","tld":"cc"},"ip":{"addr":"178.20.210.39","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-12T21:31:04.631Z","timestamp":1781299864631,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kra26at.cc","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 28 Apr 2026 19:22:52 GMT","end":"Mon, 27 Jul 2026 19:22:51 GMT"},"fingerprint":{"sha1":"0B:91:1F:0D:D8:2B:CC:F7:BA:76:0A:3E:04:6B:BB:6E:01:F0:FE:62","sha256":"BC:23:E8:B1:E5:D9:E0:34:C1:42:A5:0B:21:E1:43:74:44:6F:81:DB:E0:B9:C6:D6:46:AF:D4:AE:D4:1F:F5:18"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: kra26at.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nDate: Fri, 12 Jun 2026 21:31:04 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nX-Robots-Tag: noindex\r\nSet-Cookie: go=1; expires=Fri, 12 Jun 2026 21:41:04 GMT; Max-Age=600; path=/\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nExpires: 0\r\nLocation: https://zlon8.to?from_host=kra26at.cc\r\nStrict-Transport-Security: max-age=63072000\r\nServer: nginx, nginx\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T02:24:28.635112Z","times_seen":17437918,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-12","alert":"Sinkholed","trigger":"kra26at.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-12","alert":"Sinkholed","trigger":"kra26at.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zlon8.to/?from_host=kra26at.cc","fqdn":"zlon8.to","domain":"zlon8.to","tld":"to"},"ip":{"addr":"178.20.210.39","port":443,"asn":43260,"as":"Dgn Teknoloji A.s.","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-12T21:31:04.788Z","timestamp":1781299864788,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zlon8.to","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 10 Jun 2026 01:59:43 GMT","end":"Tue, 08 Sep 2026 01:59:42 GMT"},"fingerprint":{"sha1":"D0:EE:4F:69:38:44:D9:59:40:4E:2D:9F:C6:7D:0A:BB:5A:B4:EC:C6","sha256":"44:13:1A:FE:D0:00:6C:AE:D9:B0:78:42:D5:9B:CA:CB:50:FB:C9:3E:6F:A3:4E:33:15:EF:A8:5B:81:91:10:DB"}}},"request":{"raw":"GET /?from_host=kra26at.cc HTTP/1.1\r\nHost: zlon8.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nDate: Fri, 12 Jun 2026 21:31:04 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 0\r\nConnection: keep-alive\r\nSet-Cookie: http_refererq2=https%3A%2F%2Fkra26at.cc; expires=Fri, 12 Jun 2026 22:31:04 GMT; Max-Age=3600; path=/; domain=.zlon8.to\r\nLocation: /\r\nStrict-Transport-Security: max-age=63072000\r\nServer: nginx, nginx\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nReferrer-Policy: strict-origin-when-cross-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T02:24:28.635112Z","times_seen":17437918,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}