{"report_id":"02a58723-29d5-447f-9f24-7b0af72b584b","version":0,"status":"done","tags":[],"date":"2026-09-25T21:36:36Z","url":{"schema":"http","addr":"onlypons1.pro/onlypons1/olivia-jaymes-nude","fqdn":"onlypons1.pro","domain":"onlypons1.pro","tld":"pro"},"ip":{"addr":"104.21.85.66","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"title":"SeX","dom":{"size":8757,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"5716b4594687c2a4bf94dd5ba7b10583","sha1":"18efed32ad4ce959c469ead7e396f10077ff8f09","sha256":"a1d4fb6bfc57facc1c7c17a56fd85caf7685f83ffb5135c58da612c2c319a39f","sha512":"4e1cc2bc8a5826d5deb1c5304237301755e6e48ca09bfd951975ab8866585edc48ea8dfc14480cc779aea1d81c8710061ff52e8bff44931aae8ffaed6013d0b5","ssdeep":"96:KuGglAo/nvyRP47PzjAnhP2WHSlD3UTrKfCrBtP/QODTNpjydv6Jms/Z67:NlAo/nqs8dy4T9tP4OnNAdv6Qss7","tlshash":"5302cca0c0e1593b00a342c926e2db9f7af18e07ea46591472ed97f51fd3f99ee07016","dom_hash":"domhash5bf124c86dbd53119617112afbaa195c","first_seen":"2026-09-03T23:48:22.706166Z","last_seen":"2026-09-25T21:36:40.791713Z","times_seen":149,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"onlypons1.pro/onlypons1/olivia-jaymes-nude","fqdn":"onlypons1.pro","domain":"onlypons1.pro","tld":"pro"},"ip":{"addr":"104.21.85.66","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-30T21:36:36Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"onlypons1.pro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"ladgritperformed.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"onlypons1.pro","ip":{"addr":"172.67.203.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-25T21:36:37.233275Z","last_seen":"2026-09-25T21:36:39.637137Z","alert_count":3,"request_count":3,"received_data":5348,"sent_data":1617,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}]},{"fqdn":"waldschrat.net","ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2026-01-26","domain_rank":0,"first_seen":"2026-05-20T15:52:33.877162Z","last_seen":"2026-09-22T05:43:59.172915Z","alert_count":0,"request_count":12,"received_data":495614,"sent_data":10266,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"ladgritperformed.com","ip":{"addr":"172.255.141.4","port":443,"asn":7979,"as":"SERVERS-COM","country":"The Netherlands","country_code":"NL"},"domain_registered":"2026-09-07","domain_rank":0,"first_seen":"2026-09-12T18:30:23.239676Z","last_seen":"2026-09-19T22:17:01.323841Z","alert_count":2,"request_count":2,"received_data":3533,"sent_data":2578,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"onlypons1.pro/onlypons1/olivia-jaymes-nude","fqdn":"onlypons1.pro","domain":"onlypons1.pro","tld":"pro"},"ip":{"addr":"172.67.203.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a0b4eff74db87e317c8c4246bc65cfaa","sha1":"dde06195729bc12f7bef9f2c3be23e9250c1c077","sha256":"0127438a1149854f4e1b14dd5f8a4d2b4029fe020bfe79846b6cd8e84a407142","sha512":"cf0e414f9083bc1affa6c5c1ffd3c55f1d9fb11e7dbd1feef61a3a03093130827ce6b1e01343c49c875444b099a692c59830771b5e6b49b9f04a40b9c5834e97","ssdeep":"","tlshash":"e021ccfd32611026546750a6e2b750183127e06b79d7f4e6350c83807f98b7eb2b67cc","size":1424,"data":"","first_seen":"2026-09-12T18:30:27.161074Z","last_seen":"2026-09-25T21:36:40.802428Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waldschrat.net/landers/no01/60db6d2f642ec/60db6d2fd1240.js","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","size":89501,"data":"","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-09-25T23:17:23.553373Z","times_seen":505904,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waldschrat.net/landers/no01/60db6d2f642ec/60db6d2fd12a3.js","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"094afdb82ff8e213f148cd9f68c55b11","sha1":"2aa6959a74bd3a5c6cab97be398eacf269a83856","sha256":"4d7111e85a032d975da3280cc4f5d46ce049f91d91deecc146b9f1639b1e127a","sha512":"747f89e2f6717add1e4ee57f6251cd82268e45216467e9c86aff39388a58203a95ef86ec49bdee45941134177e69cc731c6c83c5178a4b52571c59fb51e50276","ssdeep":"","tlshash":"7611574cb46d6b7e40ff33de043e81dca83b4124b1020b68d4fc07a808aab6985f7c59","size":1031,"data":"","first_seen":"2023-03-09T22:47:03Z","last_seen":"2026-09-25T21:36:40.801227Z","times_seen":202,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"onlypons1.pro/onlypons1/olivia-jaymes-nude","fqdn":"onlypons1.pro","domain":"onlypons1.pro","tld":"pro"},"ip":{"addr":"172.67.203.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-25T21:36:08.156Z","timestamp":1790372168156,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlypons1.pro","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 24 Sep 2026 16:49:50 GMT","end":"Wed, 23 Dec 2026 16:49:49 GMT"},"fingerprint":{"sha1":"D8:E8:12:46:ED:41:8F:B5:69:F2:55:97:27:23:2A:93:68:D1:31:01","sha256":"61:D3:E8:DF:20:DD:44:C7:A1:14:26:6F:5C:EE:2A:62:37:78:D3:13:5F:9F:FD:A5:BC:89:27:4F:F1:A5:BE:9B"}}},"request":{"raw":"GET /onlypons1/olivia-jaymes-nude HTTP/1.1\r\nHost: onlypons1.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/html; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YSdFvmfY1H%2BXuwaaAcZEV2xDdlNCjI9p9rE3%2BZpHiByK3QJuQStUrKyAaG1jiLhY%2F2rqcbpa14I4fiWe16fHpY1ek4PqB4Rj70a%2F4cMEHfTtSbubp1rZBV8o6xeJjpB2\"}]}\r\nvary: Accept-Encoding\r\npriority: u=0,i\r\ndate: Fri, 25 Sep 2026 21:36:08 GMT\r\nserver: cloudflare\r\nx-powered-by: CyberPanel-OLS/2.4.4\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a40d29a369fb56c5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":1556,"size_decoded":1376,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"fbe8fc5f1d93a070054ce6b687170449","sha1":"c5d9dd07190903ecc31929a47475be6e0d1a4aee","sha256":"56831341eef8d25497263fce550d915cbf445e7057864c4219cdf4cc9c38bcf0","sha512":"d2ba84d9dd7d770d44193f032617be385b12271bc33fe0817eeb7bddbd4e32423ad7b84d0b3b9944cca852f2aae5df6ea5ac9fa18ce6ddc8a338051b0ac52b28","ssdeep":"","tlshash":"e031d9fd3562102644775096a6f7a118211be05bb9d3e8d6354cc280bf98b7eb2a37cc","first_seen":"2026-09-12T18:30:27.155404Z","last_seen":"2026-09-25T21:36:40.79291Z","times_seen":7,"resource_available":true,"data":null}},"time_used":618,"timings":{"blocked":0,"dns":49,"connect":16,"send":0,"wait":553,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"onlypons1.pro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlypons1.pro/tracker.php","fqdn":"onlypons1.pro","domain":"onlypons1.pro","tld":"pro"},"ip":{"addr":"172.67.203.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://onlypons1.pro/onlypons1/olivia-jaymes-nude","date":"2026-09-25T21:36:08.992Z","timestamp":1790372168992,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlypons1.pro","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 24 Sep 2026 16:49:50 GMT","end":"Wed, 23 Dec 2026 16:49:49 GMT"},"fingerprint":{"sha1":"D8:E8:12:46:ED:41:8F:B5:69:F2:55:97:27:23:2A:93:68:D1:31:01","sha256":"61:D3:E8:DF:20:DD:44:C7:A1:14:26:6F:5C:EE:2A:62:37:78:D3:13:5F:9F:FD:A5:BC:89:27:4F:F1:A5:BE:9B"}}},"request":{"raw":"POST /tracker.php HTTP/1.1\r\nHost: onlypons1.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded;charset=UTF-8\r\nReferer: https://onlypons1.pro/onlypons1/olivia-jaymes-nude\r\nContent-Length: 137\r\nOrigin: https://onlypons1.pro\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":137,"data":"mid=KIBAR-001\u0026url=https%3A%2F%2Fonlypons1.pro%2Fonlypons1%2Folivia-jaymes-nude\u0026ref=\u0026title=\u0026screen=1280x1024\u0026lang=en-US\u0026time=1790372168971"}},"response":{"raw":"HTTP/3 204 \r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST, OPTIONS\r\naccess-control-allow-headers: Content-Type\r\ncache-control: no-cache, no-store, must-revalidate\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Fri, 25 Sep 2026 21:36:09 GMT\r\nserver: cloudflare\r\nx-powered-by: CyberPanel-OLS/2.4.4\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kjzXFH5tSNMlO8ujh9aYhllTH4L6%2Bu1trMizaUcbilj9yt4gObgylP23vkILlAEopTyt4IAJ%2FoD58F3%2BQg5XvMLc3kP5a99xfYXRhGaAzDyvZZapkG%2BdTSvVM%2FswX1T0\"}]}\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a40d29a84ba10afa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":0,"size_decoded":1518,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-25T23:27:37.317158Z","times_seen":18659909,"resource_available":true,"data":null}},"time_used":211,"timings":{"blocked":-1,"dns":0,"connect":11,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"onlypons1.pro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlypons1.pro/favicon.ico","fqdn":"onlypons1.pro","domain":"onlypons1.pro","tld":"pro"},"ip":{"addr":"172.67.203.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlypons1.pro/onlypons1/olivia-jaymes-nude","date":"2026-09-25T21:36:08.997Z","timestamp":1790372168997,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlypons1.pro","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 24 Sep 2026 16:49:50 GMT","end":"Wed, 23 Dec 2026 16:49:49 GMT"},"fingerprint":{"sha1":"D8:E8:12:46:ED:41:8F:B5:69:F2:55:97:27:23:2A:93:68:D1:31:01","sha256":"61:D3:E8:DF:20:DD:44:C7:A1:14:26:6F:5C:EE:2A:62:37:78:D3:13:5F:9F:FD:A5:BC:89:27:4F:F1:A5:BE:9B"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: onlypons1.pro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlypons1.pro/onlypons1/olivia-jaymes-nude\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/html; charset=utf-8\r\npriority: u=6,i=?0\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gcOCtEGGnQsXgnfCxlEZPVsdgHjsqJoAn5f8Puyf7c%2B2i0s1ojrSX4CDGNyEQ06cQAgD5tKQ%2B8KhzjRh5J8J4VjwL1wWsgkMYOltXW0k8T0%2FM6H%2FTsfj4qUsBleW13Yh\"}]}\r\ndate: Fri, 25 Sep 2026 21:36:09 GMT\r\nserver: cloudflare\r\nx-powered-by: CyberPanel-OLS/2.4.4\r\nx-turbo-charged-by: LiteSpeed\r\nage: 2821\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Fri, 25 Sep 2026 20:49:07 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a40d29a83a5c56c5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":1556,"size_decoded":1462,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"fbe8fc5f1d93a070054ce6b687170449","sha1":"c5d9dd07190903ecc31929a47475be6e0d1a4aee","sha256":"56831341eef8d25497263fce550d915cbf445e7057864c4219cdf4cc9c38bcf0","sha512":"d2ba84d9dd7d770d44193f032617be385b12271bc33fe0817eeb7bddbd4e32423ad7b84d0b3b9944cca852f2aae5df6ea5ac9fa18ce6ddc8a338051b0ac52b28","ssdeep":"","tlshash":"e031d9fd3562102644775096a6f7a118211be05bb9d3e8d6354cc280bf98b7eb2a37cc","first_seen":"2026-09-12T18:30:27.155404Z","last_seen":"2026-09-25T21:36:40.79291Z","times_seen":7,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-25","alert":"Phishing Block","trigger":"onlypons1.pro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"waldschrat.net/landers/no01/60db6d2f642ec/60db6d2fd1240.js","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849","date":"2026-09-25T21:36:10.346Z","timestamp":1790372170346,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"waldschrat.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 23 Sep 2026 11:43:38 GMT","end":"Tue, 22 Dec 2026 11:43:37 GMT"},"fingerprint":{"sha1":"48:12:F6:BD:7F:9D:A6:5C:19:03:95:C7:BE:DA:CC:C4:43:AC:5F:62","sha256":"5C:C1:A4:AE:7E:0B:0D:DD:77:7D:E1:40:26:AD:23:BB:A3:DA:8A:18:1B:25:A2:AC:03:CF:CE:B4:08:52:29:A1"}}},"request":{"raw":"GET /landers/no01/60db6d2f642ec/60db6d2fd1240.js HTTP/1.1\r\nHost: waldschrat.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849\r\nCookie: uclick=yevfkwhVbNg11Or8bWCYssgml9I0PD80KW4F6nHOhUfyn1xzRO0zv74NNYrKg5PyVqf4Qb4=; bcid=dareiinm3j3s73dg24q0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: max-age=31536000, public, no-transform\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Fri, 25 Sep 2026 21:36:10 GMT\r\netag: \"6966a84d-15d9d\"\r\nexpires: Sat, 25 Sep 2027 21:36:10 GMT\r\nlast-modified: Tue, 13 Jan 2026 20:17:17 GMT\r\nserver: nginx\r\nvia: 1.1 Caddy\r\ncontent-length: 89501\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89501,"size_decoded":89867,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-09-25T23:17:23.553373Z","times_seen":505904,"resource_available":true,"data":null}},"time_used":90,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waldschrat.net/landers/no01/60db6d2f642ec/60db6d3051e68.jpg","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849","date":"2026-09-25T21:36:10.485Z","timestamp":1790372170485,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"waldschrat.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 23 Sep 2026 11:43:38 GMT","end":"Tue, 22 Dec 2026 11:43:37 GMT"},"fingerprint":{"sha1":"48:12:F6:BD:7F:9D:A6:5C:19:03:95:C7:BE:DA:CC:C4:43:AC:5F:62","sha256":"5C:C1:A4:AE:7E:0B:0D:DD:77:7D:E1:40:26:AD:23:BB:A3:DA:8A:18:1B:25:A2:AC:03:CF:CE:B4:08:52:29:A1"}}},"request":{"raw":"GET /landers/no01/60db6d2f642ec/60db6d3051e68.jpg HTTP/1.1\r\nHost: waldschrat.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://waldschrat.net/landers/no01/60db6d2f642ec/60db6d2fd12c8.css\r\nCookie: uclick=yevfkwhVbNg11Or8bWCYssgml9I0PD80KW4F6nHOhUfyn1xzRO0zv74NNYrKg5PyVqf4Qb4=; bcid=dareiinm3j3s73dg24q0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-type: image/jpeg\r\ndate: Fri, 25 Sep 2026 21:36:10 GMT\r\netag: \"6966a84c-da43\"\r\nlast-modified: Tue, 13 Jan 2026 20:17:16 GMT\r\nserver: nginx\r\nvia: 1.1 Caddy\r\ncontent-length: 55875\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55875,"size_decoded":56118,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 120x120, segment length 16, baseline, precision 8, 551x787, components 3","md5":"83986c1dfa657941d45b6938b75818ff","sha1":"9b97f085d54ee62b209701a69fe4dbd0fc154d3d","sha256":"a5583058705e2b56ca318f8ec51ed398a484f9abb3c42976fe8e3d0b29c19d13","sha512":"bd20c9d530e98431b24bfc7479f53c2712b0ba9ed5f750831e61ce14491e54b672e1ca06b0f9bdea1761b1e5ddd549de43ebd453cb824c67a8a87d156e569caf","ssdeep":"1536:QWVCmK69xc/y1vqIE5J6o2EsK7nVC73ebdgc38ZAfA0lHaHyyT1paIzUmn:vKSc/OvqIE5c67q4t+gjlHqH/aW","tlshash":"d543f1ff1637a683c75ac8b0c9202b34d5d54c7bebb8995f961d422011be2a4aa91e34","first_seen":"2024-05-05T14:20:47Z","last_seen":"2026-09-25T21:36:40.795462Z","times_seen":173,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waldschrat.net/landers/no01/60db6d2f642ec/60db6d3051e81.png","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849","date":"2026-09-25T21:36:10.487Z","timestamp":1790372170487,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"waldschrat.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 23 Sep 2026 11:43:38 GMT","end":"Tue, 22 Dec 2026 11:43:37 GMT"},"fingerprint":{"sha1":"48:12:F6:BD:7F:9D:A6:5C:19:03:95:C7:BE:DA:CC:C4:43:AC:5F:62","sha256":"5C:C1:A4:AE:7E:0B:0D:DD:77:7D:E1:40:26:AD:23:BB:A3:DA:8A:18:1B:25:A2:AC:03:CF:CE:B4:08:52:29:A1"}}},"request":{"raw":"GET /landers/no01/60db6d2f642ec/60db6d3051e81.png HTTP/1.1\r\nHost: waldschrat.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://waldschrat.net/landers/no01/60db6d2f642ec/60db6d2fd12c8.css\r\nCookie: uclick=yevfkwhVbNg11Or8bWCYssgml9I0PD80KW4F6nHOhUfyn1xzRO0zv74NNYrKg5PyVqf4Qb4=; bcid=dareiinm3j3s73dg24q0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: max-age=31536000, public, no-transform\r\ncontent-type: image/png\r\ndate: Fri, 25 Sep 2026 21:36:10 GMT\r\netag: \"6966a84b-544\"\r\nexpires: Sat, 25 Sep 2027 21:36:10 GMT\r\nlast-modified: Tue, 13 Jan 2026 20:17:15 GMT\r\nserver: nginx\r\nvia: 1.1 Caddy\r\ncontent-length: 1348\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1348,"size_decoded":1683,"mime_type":"image/png","magic":"PNG image data, 38 x 34, 8-bit/color RGBA, non-interlaced","md5":"c7c421f1cba84ea32c9b6c6bcc1d2aac","sha1":"8b397293e9fded9ba8e3388aa352649d68953b41","sha256":"6ebabeeb0c613ab768b0e5bfe6d959b78b04393b8772f8cd1ea16a246c08831d","sha512":"6cae65ccb03d1ecec748e93d8c0c410088234e0812db20ddb2ceaee27d1c77bd00a469de184df3c5d94188391276a47fbd2f16b04ee29c1e7a0140f56801a082","ssdeep":"","tlshash":"ee2108e177a189b814a0f799fcc162b0bd12330815a0f98864c93d5779eb0a58c6431f","first_seen":"2023-04-30T23:35:04Z","last_seen":"2026-09-25T21:36:40.796164Z","times_seen":262,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waldschrat.net/landers/no01/60db6d2f642ec/60db6d3051e98.jpg","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849","date":"2026-09-25T21:36:10.488Z","timestamp":1790372170488,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"waldschrat.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 23 Sep 2026 11:43:38 GMT","end":"Tue, 22 Dec 2026 11:43:37 GMT"},"fingerprint":{"sha1":"48:12:F6:BD:7F:9D:A6:5C:19:03:95:C7:BE:DA:CC:C4:43:AC:5F:62","sha256":"5C:C1:A4:AE:7E:0B:0D:DD:77:7D:E1:40:26:AD:23:BB:A3:DA:8A:18:1B:25:A2:AC:03:CF:CE:B4:08:52:29:A1"}}},"request":{"raw":"GET /landers/no01/60db6d2f642ec/60db6d3051e98.jpg HTTP/1.1\r\nHost: waldschrat.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://waldschrat.net/landers/no01/60db6d2f642ec/60db6d2fd12c8.css\r\nCookie: uclick=yevfkwhVbNg11Or8bWCYssgml9I0PD80KW4F6nHOhUfyn1xzRO0zv74NNYrKg5PyVqf4Qb4=; bcid=dareiinm3j3s73dg24q0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-type: image/jpeg\r\ndate: Fri, 25 Sep 2026 21:36:10 GMT\r\netag: \"6966a84e-1088d\"\r\nlast-modified: Tue, 13 Jan 2026 20:17:18 GMT\r\nserver: nginx\r\nvia: 1.1 Caddy\r\ncontent-length: 67725\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":67725,"size_decoded":67969,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1473x534, components 3","md5":"37b8f9cc2e7dfda742bb81c33b173b3f","sha1":"7cf8eb68e0d81ca7505bdedf10d7ea848d678444","sha256":"fe48f75b813cb86064bd97305944c96b2a3ee551340cd213a6d8475332c0c2c3","sha512":"58722d88249a3c55c5cb265cab0f76992c6ce3bc18f1dbaeba0bee68a8f4ccc1835d660dc872bef59fa436d18fc7f6979fe8ee4238b59524752b42379694d00b","ssdeep":"1536:7sfQqPjB8v5PZNjhlAhCW2yQtJ/O8vXO4qUnZU5eRW5rUzN4o:7ct8xNjrAkl1WqXO4qleRxx","tlshash":"6163025bdaa6cc76cc3234b97bd6e80a2cdea8f5274509295c1cf96488c73931e66a04","first_seen":"2023-04-30T23:35:04Z","last_seen":"2026-09-25T21:36:40.796842Z","times_seen":185,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ladgritperformed.com/api/users?token=L2N5dnNxdGo2P2ZzdHU9MDFhMGRhN2YtNDc0Yi03MzUzLWFmOTMtNTg2NGVkMWRjZmYxJmtleT1lZDA2NzdiMWIzMGE4NTVkNmIxOWVmYjc2Y2NlYmNlOCZwczE9YzU2NDJkMmM4ZDBmMGUwY2NkNDY4MDExM2MyYzEwZGEmcmVmZXI9aHR0cHMlM0ElMkYlMkZvbmx5cG9uczEucHJvJTJGJnJtdGM9dCZzaHQ9R2tuUnRlaWp2UnFUS0FxLXN6TzJ1X1FGallvXzVUVHpwdUdrRjJnRjhzayZzaHY9MiZzdDE9MTc5MDM3MjE2OTU0NjM2NDM3OSZwaWk9JmluPSZ1dWlkPQ","fqdn":"ladgritperformed.com","domain":"ladgritperformed.com","tld":"com"},"ip":{"addr":"172.255.141.4","port":443,"asn":7979,"as":"SERVERS-COM","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-25T21:36:09.869Z","timestamp":1790372169869,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ladgritperformed.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 07 Sep 2026 14:14:40 GMT","end":"Sun, 06 Dec 2026 14:14:39 GMT"},"fingerprint":{"sha1":"D6:17:AC:2E:9F:C7:65:F3:58:FE:83:37:2B:3F:AB:EB:E9:B1:00:B3","sha256":"97:1D:B9:EB:FE:B1:B4:1E:42:DB:72:D6:C8:B2:1E:49:24:02:C5:DD:3C:64:F5:56:CB:70:D9:19:5C:9D:CC:72"}}},"request":{"raw":"GET /api/users?token=L2N5dnNxdGo2P2ZzdHU9MDFhMGRhN2YtNDc0Yi03MzUzLWFmOTMtNTg2NGVkMWRjZmYxJmtleT1lZDA2NzdiMWIzMGE4NTVkNmIxOWVmYjc2Y2NlYmNlOCZwczE9YzU2NDJkMmM4ZDBmMGUwY2NkNDY4MDExM2MyYzEwZGEmcmVmZXI9aHR0cHMlM0ElMkYlMkZvbmx5cG9uczEucHJvJTJGJnJtdGM9dCZzaHQ9R2tuUnRlaWp2UnFUS0FxLXN6TzJ1X1FGallvXzVUVHpwdUdrRjJnRjhzayZzaHY9MiZzdDE9MTc5MDM3MjE2OTU0NjM2NDM3OSZwaWk9JmluPSZ1dWlkPQ HTTP/1.1\r\nHost: ladgritperformed.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ladgritperformed.com/api/users?token=L2N5dnNxdGo2P2tleT05Y2E2MDFhOWY0N2M3MzVkZjc2ZDVjYTQ2ZmEyNmE2NiZzdWJtZXRyaWM9MTg2MDQ0MzY\r\nCookie: ain=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoxODYwNDQzNiwiayI6ImVkMDY3N2IxYjMwYTg1NWQ2YjE5ZWZiNzZjY2ViY2U4Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxOTExMDY3LCJwaWQiOjk4ODc3LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjM4LCJhaWQiOjI4LCJwdCI6NCwicGsiOiJjeXZzcXRqNiIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjoyNjY1NjExMTUsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMzY5MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTM0LjAiLCJ3diI6ZmFsc2UsImUiOmZhbHNlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiY3QiOnsiaWQiOjMxNTE2MjcsIm4iOiJIb3ZpayB2ZXJrIn0sInJnIjp7ImlkIjozMjcxLCJuIjoiVmlrZW4ifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJpd2YiOnRydWUsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9vbmx5cG9uczEucHJvLyIsInR6IjoyLCJpZHVjIjowLCJhciI6W119fQ.xG1nfyVWuVhBPdLrU3vmyc01HFgAxFonVqaKFXh8m6E; cjs=t\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx/1.30.2\r\nDate: Fri, 25 Sep 2026 21:36:10 GMT\r\nContent-Type: text/html\r\nContent-Length: 0\r\nConnection: keep-alive\r\naccept-ch: Sec-Ch-Ua-Mobile,X-Device-User-Agent,X-Ucbrowser-Device-Ua,User-Agent,Sec-Ch-Ua-Full-Version-List,Sec-Ch-Ua-Full-Version,Sec-Ch-Ua-Platform,Device-Stock-Ua,X-Operamini-Phone-Ua,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Model\r\nlocation: https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849\r\nset-cookie: pdhtkv=true; Path=/; Expires=Sat, 26 Sep 2026 21:36:10 GMT; Secure; SameSite=None\nuncs=1; Path=/; Expires=Sat, 26 Sep 2026 21:36:10 GMT; Secure; SameSite=None\npdhtkv28=true; Path=/; Expires=Sat, 26 Sep 2026 21:36:10 GMT; Secure; SameSite=None\nuncs28=1; Path=/; Expires=Sat, 26 Sep 2026 21:36:10 GMT; Secure; SameSite=None\nu_pl18604436=1; Path=/; Expires=Sat, 26 Sep 2026 21:36:10 GMT; Secure; SameSite=None\niprc_c+e727f5cec2947e1d8d6ffc3b5286d0a2=1440357; Path=/; Expires=Sat, 26 Sep 2026 21:36:10 GMT; Secure; SameSite=None\niprc_c-1440357=1; Path=/; Expires=Sat, 26 Sep 2026 21:36:10 GMT; Secure; SameSite=None\r\nvary: Accept-Encoding\r\nx-envoy-upstream-service-time: 200\r\nHost: ladgritperformed.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 4f1f57387384f371fd9f0446b398abdd\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":[{"name":"pdhtkv","value":"true","quoted":false,"path":"/","expires":"2026-09-26T21:36:10Z","raw_expires":"Sat, 26 Sep 2026 21:36:10 GMT","secure":true,"http_only":false,"same_site":"None","partitioned":false,"raw":"pdhtkv=true; Path=/; Expires=Sat, 26 Sep 2026 21:36:10 GMT; Secure; SameSite=None"},{"name":"uncs","value":"1","quoted":false,"path":"/","expires":"2026-09-26T21:36:10Z","raw_expires":"Sat, 26 Sep 2026 21:36:10 GMT","secure":true,"http_only":false,"same_site":"None","partitioned":false,"raw":"uncs=1; Path=/; Expires=Sat, 26 Sep 2026 21:36:10 GMT; Secure; SameSite=None"},{"name":"pdhtkv28","value":"true","quoted":false,"path":"/","expires":"2026-09-26T21:36:10Z","raw_expires":"Sat, 26 Sep 2026 21:36:10 GMT","secure":true,"http_only":false,"same_site":"None","partitioned":false,"raw":"pdhtkv28=true; Path=/; Expires=Sat, 26 Sep 2026 21:36:10 GMT; Secure; SameSite=None"},{"name":"uncs28","value":"1","quoted":false,"path":"/","expires":"2026-09-26T21:36:10Z","raw_expires":"Sat, 26 Sep 2026 21:36:10 GMT","secure":true,"http_only":false,"same_site":"None","partitioned":false,"raw":"uncs28=1; Path=/; Expires=Sat, 26 Sep 2026 21:36:10 GMT; Secure; SameSite=None"},{"name":"u_pl18604436","value":"1","quoted":false,"path":"/","expires":"2026-09-26T21:36:10Z","raw_expires":"Sat, 26 Sep 2026 21:36:10 GMT","secure":true,"http_only":false,"same_site":"None","partitioned":false,"raw":"u_pl18604436=1; Path=/; Expires=Sat, 26 Sep 2026 21:36:10 GMT; Secure; SameSite=None"},{"name":"iprc_c+e727f5cec2947e1d8d6ffc3b5286d0a2","value":"1440357","quoted":false,"path":"/","expires":"2026-09-26T21:36:10Z","raw_expires":"Sat, 26 Sep 2026 21:36:10 GMT","secure":true,"http_only":false,"same_site":"None","partitioned":false,"raw":"iprc_c+e727f5cec2947e1d8d6ffc3b5286d0a2=1440357; Path=/; Expires=Sat, 26 Sep 2026 21:36:10 GMT; Secure; SameSite=None"},{"name":"iprc_c-1440357","value":"1","quoted":false,"path":"/","expires":"2026-09-26T21:36:10Z","raw_expires":"Sat, 26 Sep 2026 21:36:10 GMT","secure":true,"http_only":false,"same_site":"None","partitioned":false,"raw":"iprc_c-1440357=1; Path=/; Expires=Sat, 26 Sep 2026 21:36:10 GMT; Secure; SameSite=None"}],"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-25T23:27:37.317158Z","times_seen":18659909,"resource_available":true,"data":null}},"time_used":228,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":228,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"ladgritperformed.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"waldschrat.net/landers/no01/60db6d2f642ec/60db6d2fd11bc.gif","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849","date":"2026-09-25T21:36:10.355Z","timestamp":1790372170355,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"waldschrat.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 23 Sep 2026 11:43:38 GMT","end":"Tue, 22 Dec 2026 11:43:37 GMT"},"fingerprint":{"sha1":"48:12:F6:BD:7F:9D:A6:5C:19:03:95:C7:BE:DA:CC:C4:43:AC:5F:62","sha256":"5C:C1:A4:AE:7E:0B:0D:DD:77:7D:E1:40:26:AD:23:BB:A3:DA:8A:18:1B:25:A2:AC:03:CF:CE:B4:08:52:29:A1"}}},"request":{"raw":"GET /landers/no01/60db6d2f642ec/60db6d2fd11bc.gif HTTP/1.1\r\nHost: waldschrat.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849\r\nCookie: uclick=yevfkwhVbNg11Or8bWCYssgml9I0PD80KW4F6nHOhUfyn1xzRO0zv74NNYrKg5PyVqf4Qb4=; bcid=dareiinm3j3s73dg24q0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: max-age=31536000, public, no-transform\r\ncontent-type: image/gif\r\ndate: Fri, 25 Sep 2026 21:36:10 GMT\r\netag: \"6966a84d-1905f\"\r\nexpires: Sat, 25 Sep 2027 21:36:10 GMT\r\nlast-modified: Tue, 13 Jan 2026 20:17:17 GMT\r\nserver: nginx\r\nvia: 1.1 Caddy\r\ncontent-length: 102495\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":102495,"size_decoded":102834,"mime_type":"image/gif","magic":"GIF image data, version 89a, 350 x 350","md5":"78b803a76793d8269b3c25b9e138f987","sha1":"31ac2afa94e8b2b90e5854aa4c7a4820c4d362b9","sha256":"c7019cba2004ebe060ca044a6de3c7013f0b8a46871b6cd4aad62200686fd317","sha512":"a8110d83e434b7b6350f86c10e774599e7e825c85a8a11bdc6b0acb700278f1ec109930d623d1ac80722a7560c279e217b10e408f2bc1c7bd91f984d87ac5be2","ssdeep":"1536:LNwvL6u0kYQDUdsbnHMxo+TbIIgUMJvQznzVoDLsD6KonV60maj6AdBNO+yMcu/J:LuYklDUdAwRSxQzzarhV61aegSz9uwZW","tlshash":"86a312ff91d84c7da8ae2b83963820dcf23f5c542f6180625e9f59d91bda5e0e90c41a","first_seen":"2023-04-16T06:52:29Z","last_seen":"2026-09-25T21:36:40.797465Z","times_seen":521,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waldschrat.net/landers/no01/60db6d2f642ec/60db6d2fd120d.gif","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849","date":"2026-09-25T21:36:10.356Z","timestamp":1790372170356,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"waldschrat.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 23 Sep 2026 11:43:38 GMT","end":"Tue, 22 Dec 2026 11:43:37 GMT"},"fingerprint":{"sha1":"48:12:F6:BD:7F:9D:A6:5C:19:03:95:C7:BE:DA:CC:C4:43:AC:5F:62","sha256":"5C:C1:A4:AE:7E:0B:0D:DD:77:7D:E1:40:26:AD:23:BB:A3:DA:8A:18:1B:25:A2:AC:03:CF:CE:B4:08:52:29:A1"}}},"request":{"raw":"GET /landers/no01/60db6d2f642ec/60db6d2fd120d.gif HTTP/1.1\r\nHost: waldschrat.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849\r\nCookie: uclick=yevfkwhVbNg11Or8bWCYssgml9I0PD80KW4F6nHOhUfyn1xzRO0zv74NNYrKg5PyVqf4Qb4=; bcid=dareiinm3j3s73dg24q0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: max-age=31536000, public, no-transform\r\ncontent-type: image/gif\r\ndate: Fri, 25 Sep 2026 21:36:10 GMT\r\netag: \"6966a84b-2b\"\r\nexpires: Sat, 25 Sep 2027 21:36:10 GMT\r\nlast-modified: Tue, 13 Jan 2026 20:17:15 GMT\r\nserver: nginx\r\nvia: 1.1 Caddy\r\ncontent-length: 43\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43,"size_decoded":375,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"ad4b0f606e0f8465bc4c4c170b37e1a3","sha1":"50b30fd5f87c85fe5cba2635cb83316ca71250d7","sha256":"cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda","sha512":"ebfe0c0df4bcc167d5cb6ebdd379f9083df62bef63a23818e1c6adf0f64b65467ea58b7cd4d03cf0a1b1a2b07fb7b969bf35f25f1f8538cc65cf3eebdf8a0910","ssdeep":"","tlshash":"15900003fbc08002c2b2e0300b3b0380238ce2200aa8030b80aeb0acecaa3a20c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-09-25T23:34:16.736881Z","times_seen":379832,"resource_available":true,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waldschrat.net/landers/no01/60db6d2f642ec/60db6d2fd12f5.ico","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849","date":"2026-09-25T21:36:10.538Z","timestamp":1790372170538,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"waldschrat.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 23 Sep 2026 11:43:38 GMT","end":"Tue, 22 Dec 2026 11:43:37 GMT"},"fingerprint":{"sha1":"48:12:F6:BD:7F:9D:A6:5C:19:03:95:C7:BE:DA:CC:C4:43:AC:5F:62","sha256":"5C:C1:A4:AE:7E:0B:0D:DD:77:7D:E1:40:26:AD:23:BB:A3:DA:8A:18:1B:25:A2:AC:03:CF:CE:B4:08:52:29:A1"}}},"request":{"raw":"GET /landers/no01/60db6d2f642ec/60db6d2fd12f5.ico HTTP/1.1\r\nHost: waldschrat.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849\r\nCookie: uclick=yevfkwhVbNg11Or8bWCYssgml9I0PD80KW4F6nHOhUfyn1xzRO0zv74NNYrKg5PyVqf4Qb4=; bcid=dareiinm3j3s73dg24q0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-type: image/x-icon\r\ndate: Fri, 25 Sep 2026 21:36:10 GMT\r\netag: \"6966a84b-47e\"\r\nlast-modified: Tue, 13 Jan 2026 20:17:15 GMT\r\nserver: nginx\r\nvia: 1.1 Caddy\r\ncontent-length: 1150\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1150,"size_decoded":1393,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel","md5":"8661b45538e3d8b664dd584cadc799ea","sha1":"e1bd23cc6745f7c0f652434b0f1c29c62cd6345b","sha256":"d97e8723706e1aa2d9bf203541f652df24527f48fc71238e2b3c1a50b5865fc4","sha512":"48998195797b33d6e69050c6ee672fd2c571d70ada45dd0f900d9e0f9ddc98f4cfca97a9fe32f358dafbb40a02537dcb2f79a01bfffdc95e2371e5cef488b85b","ssdeep":"","tlshash":"4a212f25341c2c23da15ea3594eb63c16d9ce6207132b419281630c1793f00b87ab8ba","first_seen":"2023-05-03T13:58:26Z","last_seen":"2026-09-25T21:36:40.798727Z","times_seen":230,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ladgritperformed.com/cyvsqtj6?key=ed0677b1b30a855d6b19efb76ccebce8","fqdn":"ladgritperformed.com","domain":"ladgritperformed.com","tld":"com"},"ip":{"addr":"172.255.141.4","port":443,"asn":7979,"as":"SERVERS-COM","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-25T21:36:09.475Z","timestamp":1790372169475,"http_version":"HTTP/1.1","security_state":"secure","security_info":null,"request":{"raw":"GET /cyvsqtj6?key=ed0677b1b30a855d6b19efb76ccebce8 HTTP/1.1\r\nHost: ladgritperformed.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlypons1.pro/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.30.2\r\nDate: Fri, 25 Sep 2026 21:36:09 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\naccept-ch: Sec-Ch-Ua-Model,Sec-Ch-Ua-Mobile,X-Device-User-Agent,User-Agent,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version-List,Sec-Ch-Ua-Platform,Device-Stock-Ua,X-Operamini-Phone-Ua,X-Ucbrowser-Device-Ua,Sec-Ch-Ua-Full-Version\r\ncontent-encoding: zstd\r\nset-cookie: ain=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoxODYwNDQzNiwiayI6ImVkMDY3N2IxYjMwYTg1NWQ2YjE5ZWZiNzZjY2ViY2U4Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxOTExMDY3LCJwaWQiOjk4ODc3LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjM4LCJhaWQiOjI4LCJwdCI6NCwicGsiOiJjeXZzcXRqNiIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjoyNjY1NjExMTUsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMzY5MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTM0LjAiLCJ3diI6ZmFsc2UsImUiOmZhbHNlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiY3QiOnsiaWQiOjMxNTE2MjcsIm4iOiJIb3ZpayB2ZXJrIn0sInJnIjp7ImlkIjozMjcxLCJuIjoiVmlrZW4ifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJpd2YiOnRydWUsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9vbmx5cG9uczEucHJvLyIsInR6IjoyLCJpZHVjIjowLCJhciI6W119fQ.xG1nfyVWuVhBPdLrU3vmyc01HFgAxFonVqaKFXh8m6E; Path=/; Expires=Fri, 25 Sep 2026 21:37:09 GMT; Secure; SameSite=None\r\nvary: Accept-Encoding\r\nx-envoy-upstream-service-time: 2\r\nHost: ladgritperformed.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 0b28b1708398b580062f5e5051e9a271\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":[{"name":"ain","value":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoxODYwNDQzNiwiayI6ImVkMDY3N2IxYjMwYTg1NWQ2YjE5ZWZiNzZjY2ViY2U4Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxOTExMDY3LCJwaWQiOjk4ODc3LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjM4LCJhaWQiOjI4LCJwdCI6NCwicGsiOiJjeXZzcXRqNiIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjoyNjY1NjExMTUsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMzY5MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTM0LjAiLCJ3diI6ZmFsc2UsImUiOmZhbHNlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiY3QiOnsiaWQiOjMxNTE2MjcsIm4iOiJIb3ZpayB2ZXJrIn0sInJnIjp7ImlkIjozMjcxLCJuIjoiVmlrZW4ifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJpd2YiOnRydWUsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9vbmx5cG9uczEucHJvLyIsInR6IjoyLCJpZHVjIjowLCJhciI6W119fQ.xG1nfyVWuVhBPdLrU3vmyc01HFgAxFonVqaKFXh8m6E","quoted":false,"path":"/","expires":"2026-09-25T21:37:09Z","raw_expires":"Fri, 25 Sep 2026 21:37:09 GMT","secure":true,"http_only":false,"same_site":"None","partitioned":false,"raw":"ain=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwIjp7ImlkIjoxODYwNDQzNiwiayI6ImVkMDY3N2IxYjMwYTg1NWQ2YjE5ZWZiNzZjY2ViY2U4Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxOTExMDY3LCJwaWQiOjk4ODc3LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjM4LCJhaWQiOjI4LCJwdCI6NCwicGsiOiJjeXZzcXRqNiIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjoyNjY1NjExMTUsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMzY5MjUsImJuIjoiRmlyZWZveCIsImJ2IjoiMTM0LjAiLCJ3diI6ZmFsc2UsImUiOmZhbHNlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiY3QiOnsiaWQiOjMxNTE2MjcsIm4iOiJIb3ZpayB2ZXJrIn0sInJnIjp7ImlkIjozMjcxLCJuIjoiVmlrZW4ifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJpd2YiOnRydWUsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly9vbmx5cG9uczEucHJvLyIsInR6IjoyLCJpZHVjIjowLCJhciI6W119fQ.xG1nfyVWuVhBPdLrU3vmyc01HFgAxFonVqaKFXh8m6E; Path=/; Expires=Fri, 25 Sep 2026 21:37:09 GMT; Secure; SameSite=None"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-25T23:27:37.317158Z","times_seen":18659909,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"ladgritperformed.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-25T21:36:10.102Z","timestamp":1790372170102,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"waldschrat.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 23 Sep 2026 11:43:38 GMT","end":"Tue, 22 Dec 2026 11:43:37 GMT"},"fingerprint":{"sha1":"48:12:F6:BD:7F:9D:A6:5C:19:03:95:C7:BE:DA:CC:C4:43:AC:5F:62","sha256":"5C:C1:A4:AE:7E:0B:0D:DD:77:7D:E1:40:26:AD:23:BB:A3:DA:8A:18:1B:25:A2:AC:03:CF:CE:B4:08:52:29:A1"}}},"request":{"raw":"GET /c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849 HTTP/1.1\r\nHost: waldschrat.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ladgritperformed.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html; charset=UTF-8\r\ndate: Fri, 25 Sep 2026 21:36:10 GMT\r\nset-cookie: uclick=yevfkwhVbNg11Or8bWCYssgml9I0PD80KW4F6nHOhUfyn1xzRO0zv74NNYrKg5PyVqf4Qb4=; Max-Age=31536000; SameSite=Lax\nbcid=dareiinm3j3s73dg24q0; Max-Age=31536000; SameSite=Lax\r\nvia: 1.1 Caddy\r\nx-request-id: baccc7b3-6039-4552-996f-506ac191964f\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"uclick","value":"yevfkwhVbNg11Or8bWCYssgml9I0PD80KW4F6nHOhUfyn1xzRO0zv74NNYrKg5PyVqf4Qb4=","quoted":false,"max_age":31536000,"secure":false,"http_only":false,"same_site":"Lax","partitioned":false,"raw":"uclick=yevfkwhVbNg11Or8bWCYssgml9I0PD80KW4F6nHOhUfyn1xzRO0zv74NNYrKg5PyVqf4Qb4=; Max-Age=31536000; SameSite=Lax"},{"name":"bcid","value":"dareiinm3j3s73dg24q0","quoted":false,"max_age":31536000,"secure":false,"http_only":false,"same_site":"Lax","partitioned":false,"raw":"bcid=dareiinm3j3s73dg24q0; Max-Age=31536000; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":8972,"size_decoded":9335,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"bc48f53e8eb68ab5f03162af99fcc71e","sha1":"d9ba8a2bc3dbde56ac1b1e21e939e7ebcd811da9","sha256":"c979f46a121dfc617c0c535f00a5c6453d2fa565b23406b6940a80859668e44f","sha512":"65a2c2e3152fc58a39b8bce918e44524a554897fb9773161e90ed9374d10d5ab2e74493d8a0fc1f50a277e7b293823e40ea9605f479ec3a18901372e6cfb1426","ssdeep":"96:muNK+N/YkyRB7hI2niFWH4kDOUTrX9PzBFrxJ5w2UspDks6J9u/a6V:i+N/YZBtrzLTnFrv5PU4ks6Hu5V","tlshash":"c10289a0c092592b01b342d94a62db9efaf18607eb46591472ee57f31ff3f18ee07016","first_seen":"2026-09-03T23:48:22.710665Z","last_seen":"2026-09-25T21:36:40.799365Z","times_seen":156,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":0,"dns":6,"connect":30,"send":0,"wait":78,"receive":0,"ssl":39},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waldschrat.net/landers/no01/60db6d2f642ec/60db6d2fd12c8.css","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849","date":"2026-09-25T21:36:10.344Z","timestamp":1790372170344,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"waldschrat.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 23 Sep 2026 11:43:38 GMT","end":"Tue, 22 Dec 2026 11:43:37 GMT"},"fingerprint":{"sha1":"48:12:F6:BD:7F:9D:A6:5C:19:03:95:C7:BE:DA:CC:C4:43:AC:5F:62","sha256":"5C:C1:A4:AE:7E:0B:0D:DD:77:7D:E1:40:26:AD:23:BB:A3:DA:8A:18:1B:25:A2:AC:03:CF:CE:B4:08:52:29:A1"}}},"request":{"raw":"GET /landers/no01/60db6d2f642ec/60db6d2fd12c8.css HTTP/1.1\r\nHost: waldschrat.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849\r\nCookie: uclick=yevfkwhVbNg11Or8bWCYssgml9I0PD80KW4F6nHOhUfyn1xzRO0zv74NNYrKg5PyVqf4Qb4=; bcid=dareiinm3j3s73dg24q0\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: max-age=31536000, public, no-transform\r\ncontent-type: text/css\r\ndate: Fri, 25 Sep 2026 21:36:10 GMT\r\netag: \"6966a84d-11e6\"\r\nexpires: Sat, 25 Sep 2027 21:36:10 GMT\r\nlast-modified: Tue, 13 Jan 2026 20:17:17 GMT\r\nserver: nginx\r\nvia: 1.1 Caddy\r\ncontent-length: 4582\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4582,"size_decoded":4917,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"1052a72056b16ecce7a9ea5495751553","sha1":"726a4571b3db1816e82a61b5e08512f266b72d85","sha256":"6f358f1f25699820037c35effb027edbf455299fc1fb1f362eb787da2d9a41f5","sha512":"811e32de418bacdce2ed0158854168a22b73455f3868a7a053e132d928f6e1f7ba198c0929190d67a03f2cb7e82496fbe101be99b21ec663d3b1520a52e3d618","ssdeep":"96:7pjrGJMFAKalmpIcAMfRRhAl170VseB5os4WhmnSd07RfkEsJbRnj3ifZt9:7pjrerUrAMtAl170FHdhLa7RkEsJ1j3i","tlshash":"d5914335da442009b13ea6f4bfb147aafe6c1023770b093cbae07669db6646dd1327c4","first_seen":"2024-08-19T21:43:07.422911Z","last_seen":"2026-09-25T21:36:40.800003Z","times_seen":158,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waldschrat.net/landers/no01/60db6d2f642ec/60db6d2fd1276.js","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849","date":"2026-09-25T21:36:10.350Z","timestamp":1790372170350,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"waldschrat.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 23 Sep 2026 11:43:38 GMT","end":"Tue, 22 Dec 2026 11:43:37 GMT"},"fingerprint":{"sha1":"48:12:F6:BD:7F:9D:A6:5C:19:03:95:C7:BE:DA:CC:C4:43:AC:5F:62","sha256":"5C:C1:A4:AE:7E:0B:0D:DD:77:7D:E1:40:26:AD:23:BB:A3:DA:8A:18:1B:25:A2:AC:03:CF:CE:B4:08:52:29:A1"}}},"request":{"raw":"GET /landers/no01/60db6d2f642ec/60db6d2fd1276.js HTTP/1.1\r\nHost: waldschrat.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849\r\nCookie: uclick=yevfkwhVbNg11Or8bWCYssgml9I0PD80KW4F6nHOhUfyn1xzRO0zv74NNYrKg5PyVqf4Qb4=; bcid=dareiinm3j3s73dg24q0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: max-age=31536000, public, no-transform\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Fri, 25 Sep 2026 21:36:10 GMT\r\netag: \"6966a84d-92\"\r\nexpires: Sat, 25 Sep 2027 21:36:10 GMT\r\nlast-modified: Tue, 13 Jan 2026 20:17:17 GMT\r\nserver: nginx\r\nvia: 1.1 Caddy\r\ncontent-length: 146\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":507,"mime_type":"application/javascript; charset=utf-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-09-25T23:29:48.6053Z","times_seen":562830,"resource_available":true,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":86,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waldschrat.net/landers/no01/60db6d2f642ec/60db6d2fd12a3.js","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849","date":"2026-09-25T21:36:10.352Z","timestamp":1790372170352,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"waldschrat.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 23 Sep 2026 11:43:38 GMT","end":"Tue, 22 Dec 2026 11:43:37 GMT"},"fingerprint":{"sha1":"48:12:F6:BD:7F:9D:A6:5C:19:03:95:C7:BE:DA:CC:C4:43:AC:5F:62","sha256":"5C:C1:A4:AE:7E:0B:0D:DD:77:7D:E1:40:26:AD:23:BB:A3:DA:8A:18:1B:25:A2:AC:03:CF:CE:B4:08:52:29:A1"}}},"request":{"raw":"GET /landers/no01/60db6d2f642ec/60db6d2fd12a3.js HTTP/1.1\r\nHost: waldschrat.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849\r\nCookie: uclick=yevfkwhVbNg11Or8bWCYssgml9I0PD80KW4F6nHOhUfyn1xzRO0zv74NNYrKg5PyVqf4Qb4=; bcid=dareiinm3j3s73dg24q0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: max-age=31536000, public, no-transform\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Fri, 25 Sep 2026 21:36:10 GMT\r\netag: \"6966a84d-407\"\r\nexpires: Sat, 25 Sep 2027 21:36:10 GMT\r\nlast-modified: Tue, 13 Jan 2026 20:17:17 GMT\r\nserver: nginx\r\nvia: 1.1 Caddy\r\ncontent-length: 1031\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1031,"size_decoded":1394,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"094afdb82ff8e213f148cd9f68c55b11","sha1":"2aa6959a74bd3a5c6cab97be398eacf269a83856","sha256":"4d7111e85a032d975da3280cc4f5d46ce049f91d91deecc146b9f1639b1e127a","sha512":"747f89e2f6717add1e4ee57f6251cd82268e45216467e9c86aff39388a58203a95ef86ec49bdee45941134177e69cc731c6c83c5178a4b52571c59fb51e50276","ssdeep":"","tlshash":"7611574cb46d6b7e40ff33de043e81dca83b4124b1020b68d4fc07a808aab6985f7c59","first_seen":"2023-03-09T22:47:03Z","last_seen":"2026-09-25T21:36:40.801227Z","times_seen":202,"resource_available":true,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":84,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waldschrat.net/landers/no01/60db6d2f642ec/60db6d3051e34.jpg","fqdn":"waldschrat.net","domain":"waldschrat.net","tld":"net"},"ip":{"addr":"5.45.95.54","port":443,"asn":58061,"as":"Scalaxy B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://waldschrat.net/c881l7k.php?key=100gqh2v9pxy7j6rsali\u0026PLACEMENT_ID=18604436\u0026CAMPAIGN_ID=1440357\u0026DEVICE_BRAND=Unknown\u0026BROWSER_NAME=Firefox\u0026USER_OS=Windows\u0026USER_CARRIER=Blix%20Solutions\u0026USERAGENT=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0%29%20Gecko%2F20100101%20Firefox%2F134.0\u0026REMOTE_LANGUAGE=11\u0026BANNER_ID=3801849","date":"2026-09-25T21:36:10.471Z","timestamp":1790372170471,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"waldschrat.net","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 23 Sep 2026 11:43:38 GMT","end":"Tue, 22 Dec 2026 11:43:37 GMT"},"fingerprint":{"sha1":"48:12:F6:BD:7F:9D:A6:5C:19:03:95:C7:BE:DA:CC:C4:43:AC:5F:62","sha256":"5C:C1:A4:AE:7E:0B:0D:DD:77:7D:E1:40:26:AD:23:BB:A3:DA:8A:18:1B:25:A2:AC:03:CF:CE:B4:08:52:29:A1"}}},"request":{"raw":"GET /landers/no01/60db6d2f642ec/60db6d3051e34.jpg HTTP/1.1\r\nHost: waldschrat.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://waldschrat.net/landers/no01/60db6d2f642ec/60db6d2fd12c8.css\r\nCookie: uclick=yevfkwhVbNg11Or8bWCYssgml9I0PD80KW4F6nHOhUfyn1xzRO0zv74NNYrKg5PyVqf4Qb4=; bcid=dareiinm3j3s73dg24q0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-type: image/jpeg\r\ndate: Fri, 25 Sep 2026 21:36:10 GMT\r\netag: \"6966a84d-26d01\"\r\nlast-modified: Tue, 13 Jan 2026 20:17:17 GMT\r\nserver: nginx\r\nvia: 1.1 Caddy\r\ncontent-length: 158977\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":158977,"size_decoded":159222,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 120x120, segment length 16, baseline, precision 8, 1550x787, components 3","md5":"473b3893f015371622a4e9da30c37ce9","sha1":"cee64792038b038ad91ce7e22885bfa70b7820b3","sha256":"88cd85f6e0d6e4bfbe657f6088b587121a7e5b6737c3bef9b728a7a4dfdddca7","sha512":"36c9e15b49734f7e76236e7cdbb3e81dcbbaf3dd91f36d61ae0b508fbfc0308a8e50e84f06f2bfe6245ebd298c5d6c903abac1f17de75e3466a5f5260e3af1d2","ssdeep":"3072:SoKa6bcfDxB4V+KlfQHGbxYVA6120ZwDdg1LkBOj:WTGQ+Kl6GC1Bkg1oI","tlshash":"daf31201245cd334559eacb1f94291a3e0deb3d0c79ef747ed2208b6aa11fd7928f2a4","first_seen":"2024-05-05T14:20:47Z","last_seen":"2026-09-25T21:36:40.801842Z","times_seen":175,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}