{"report_id":"03109cd0-4b75-4379-ac4c-6a4373cb611a","version":6,"status":"done","tags":[],"date":"2026-03-24T01:57:53Z","url":{"schema":"http","addr":"wrth.info/","fqdn":"wrth.info","domain":"wrth.info","tld":"info"},"ip":{"addr":"217.160.0.155","port":0,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"wrth.info/","fqdn":"wrth.info","domain":"wrth.info","tld":"info"},"title":"is under construction","dom":{"size":2141,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"42e223d27eb61cc280ce23d9829b1cf3","sha1":"2b8df1fde9cb8c9d799ea30909e7d5e0bfd095e4","sha256":"72f1e134cd0bba7d6f0a70992625b5057ec9a1d827e046f8deec6e5abf3f7a9e","sha512":"9f092c3e9181ebca878e03813c7950861a6f42f25f823fa43ef16925a6942beba828c8e4d6fd4e8a7257f45b5212166422484f5d3b7786a9b17f11744f53f0c9","ssdeep":"","tlshash":"0b41213310b565136175c2e5b0917909db89d297e52ec582f5ac05ad8fd0f93cc6bb4c","dom_hash":"domhash1715374a68b0d2949db25c8d1b02b110","first_seen":"2026-03-24T01:57:54.967495Z","last_seen":"2026-03-24T01:57:54.967495Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"wrth.info/","fqdn":"wrth.info","domain":"wrth.info","tld":"info"},"ip":{"addr":"217.160.0.155","port":0,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-28T01:57:53Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"wrth.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.bunny.net","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"1999-11-22","domain_rank":56787,"first_seen":"2022-03-21T07:38:02Z","last_seen":"2026-03-23T04:56:19.238379Z","alert_count":0,"request_count":2,"received_data":35346,"sent_data":959,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]},{"fqdn":"wrth.info","ip":{"addr":"217.160.0.155","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"domain_registered":"2023-01-24","domain_rank":0,"first_seen":"2026-03-19T23:47:31.345978Z","last_seen":"2026-03-19T23:47:31.345978Z","alert_count":32,"request_count":8,"received_data":403070,"sent_data":4002,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"PHP:8.3.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"wrth.info/wp-content/plugins/under-construction-page/themes/images/favicon.png","fqdn":"wrth.info","domain":"wrth.info","tld":"info"},"ip":{"addr":"217.160.0.155","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wrth.info/","date":"2026-03-24T01:57:32.111Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.wrth.info","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 20 Mar 2026 00:00:00 GMT","end":"Wed, 16 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D2:47:4B:4E:04:EB:81:59:92:E2:B0:1C:80:B1:2D:CC:F1:93:E6:86","sha256":"25:FE:C4:0E:E2:82:1A:42:DC:79:77:76:B7:DC:1A:17:60:97:87:ED:6A:56:29:AB:17:29:E9:28:70:7B:2D:3A"}}},"request":{"raw":"GET /wp-content/plugins/under-construction-page/themes/images/favicon.png HTTP/1.1\r\nHost: wrth.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wrth.info/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 4026\r\nx-ws-origin: available\r\nx-ws-ratelimit-limit: 1000\r\nx-ws-ratelimit-remaining: 993\r\ndate: Tue, 24 Mar 2026 01:57:32 GMT\r\nserver: Apache\r\nlast-modified: Sun, 22 Mar 2026 13:21:41 GMT\r\netag: \"fba-64d9ccc849b96\"\r\naccept-ranges: bytes\r\ncache-control: max-age=2419200\r\nexpires: Tue, 21 Apr 2026 01:57:32 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":4026,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"681d9fea92467c7f1ed22bde59350c24","sha1":"657b331834626baac8592984a683d64cbc38e045","sha256":"8386858d306bc25e56bce985206c92c1cfb06466a5cd98c6cc935383417277e0","sha512":"98c4500b234c10eb245ff9b22ff4b2a5101c9e7133a38cd69f08b497279f8a46a8499a93b7c33fe5aeecddd820434a838d97dd105ed6e3255edd37f6baf653f4","ssdeep":"","tlshash":"cd817c8da00867e8e5ce805770de10a89bf3ce081ba3b53b263e378579e450d64d02f1","first_seen":"2023-05-01T06:45:09Z","last_seen":"2026-08-09T18:47:27.000474Z","times_seen":1323,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"wrth.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wrth.info/wp-content/plugins/under-construction-page/themes/fonts/fontawesome-webfont.woff2?v=4.7.0","fqdn":"wrth.info","domain":"wrth.info","tld":"info"},"ip":{"addr":"217.160.0.155","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://wrth.info/","date":"2026-03-24T01:57:32.138Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.wrth.info","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 20 Mar 2026 00:00:00 GMT","end":"Wed, 16 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D2:47:4B:4E:04:EB:81:59:92:E2:B0:1C:80:B1:2D:CC:F1:93:E6:86","sha256":"25:FE:C4:0E:E2:82:1A:42:DC:79:77:76:B7:DC:1A:17:60:97:87:ED:6A:56:29:AB:17:29:E9:28:70:7B:2D:3A"}}},"request":{"raw":"GET /wp-content/plugins/under-construction-page/themes/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1\r\nHost: wrth.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wrth.info/wp-content/plugins/under-construction-page/themes/css/font-awesome.min.css?v=4.04\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: font/woff2\r\ncontent-length: 77160\r\nx-ws-origin: available\r\nx-ws-ratelimit-limit: 1000\r\nx-ws-ratelimit-remaining: 992\r\ndate: Tue, 24 Mar 2026 01:57:32 GMT\r\nserver: Apache\r\nlast-modified: Sun, 22 Mar 2026 13:21:41 GMT\r\netag: \"12d68-64d9ccc848bf6\"\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":77160,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 77160, version 4.459","md5":"af7ae505a9eed503f8b8e6982036873e","sha1":"d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c","sha256":"2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe","sha512":"838fefdbc14901f41edf995a78fdac55764cd4912ccb734b8bea4909194582904d8f2afdf2b6c428667912ce4d65681a1044d045d1bc6de2b14113f0315fc892","ssdeep":"1536:/MkbAPfd1vyBKwHz4kco36ZvIaBfRPlajyXUA2jVTc:L0nXnHdfRVEAS2","tlshash":"7d7302e63b6c4943e03d6460708abe9f104b3ab42fe057e5c876db7f2722992b71552c","first_seen":"2023-04-05T03:30:47Z","last_seen":"2026-08-09T22:47:45.126455Z","times_seen":529364,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":42,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"wrth.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.bunny.net/css?family=Roboto:400,900","fqdn":"fonts.bunny.net","domain":"bunny.net","tld":"net"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wrth.info/","date":"2026-03-24T01:57:31.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fonts.bunny.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 03:04:21 GMT","end":"Fri, 22 May 2026 03:04:20 GMT"},"fingerprint":{"sha1":"4B:2A:86:15:05:FF:29:84:62:F8:36:DC:E9:F9:21:E0:E0:25:D6:B7","sha256":"DF:9D:6C:C0:B2:8C:6F:83:63:FA:A4:69:D0:8C:35:1D:15:3D:19:AF:3F:15:46:FF:C6:C1:B1:20:89:A9:CD:CF"}}},"request":{"raw":"GET /css?family=Roboto:400,900 HTTP/1.1\r\nHost: fonts.bunny.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wrth.info/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 24 Mar 2026 01:57:32 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Accept-Encoding\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 781720\r\ncdn-requestcountrycode: NO\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\naccess-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\ncache-control: public, max-age=2592000\r\nlast-modified: Sun, 22 Mar 2026 15:52:15 GMT\r\ncdn-proxyver: 1.49\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 03/22/2026 15:52:15\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 9498df8703caaaf2414085be94f374c7\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":11604,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1445)","md5":"d48188508f840e03396c0f0cc8117d82","sha1":"cb6ac6c7216aa9745024885d0f9a21d99f3553f3","sha256":"28b76d5df4dce956f7badd70612304b12e4a97678a1c6ab2bb72e80b78412a28","sha512":"2b37f162a819f8fcf1cf822f6230c3e2e70cc03088664484db7c15898f96501eb1d0f655f43089814a2c190519f3167824a29d06934542e9195d967d6d4c596a","ssdeep":"192:tYJsz36E3S5fOHRjs7zl6UDpDLq+4C8JTzwwq3BLfOHRjTMzOOGDpcL9NH3:GJW3NqfgRjclp3qPJXwR1fgRjqOna9t","tlshash":"9432cfb700192440d3c758a323da5e14be1f91067389f056eb2cdce4afeaa7947e636d","first_seen":"2026-03-23T15:22:39.395366Z","last_seen":"2026-08-09T18:47:26.987902Z","times_seen":217,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":78,"dns":46,"connect":17,"send":0,"wait":18,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wrth.info/wp-content/plugins/under-construction-page/themes/css/common.css?v=4.04","fqdn":"wrth.info","domain":"wrth.info","tld":"info"},"ip":{"addr":"217.160.0.155","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wrth.info/","date":"2026-03-24T01:57:31.946Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.wrth.info","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 20 Mar 2026 00:00:00 GMT","end":"Wed, 16 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D2:47:4B:4E:04:EB:81:59:92:E2:B0:1C:80:B1:2D:CC:F1:93:E6:86","sha256":"25:FE:C4:0E:E2:82:1A:42:DC:79:77:76:B7:DC:1A:17:60:97:87:ED:6A:56:29:AB:17:29:E9:28:70:7B:2D:3A"}}},"request":{"raw":"GET /wp-content/plugins/under-construction-page/themes/css/common.css?v=4.04 HTTP/1.1\r\nHost: wrth.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wrth.info/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css\r\ncontent-length: 469\r\nx-ws-origin: available\r\nx-ws-ratelimit-limit: 1000\r\nx-ws-ratelimit-remaining: 997\r\ndate: Tue, 24 Mar 2026 01:57:31 GMT\r\nserver: Apache\r\nlast-modified: Sun, 22 Mar 2026 13:21:41 GMT\r\netag: \"36e-64d9ccc846cb6-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=2419200\r\nexpires: Tue, 21 Apr 2026 01:57:31 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":878,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"ff5f4043c56a489170d734b484ca89ce","sha1":"16784187421cc67e0fca55906fb788ac672c3598","sha256":"dc64cd943b89cddfc8078ea6238b4e26a4d94156225332777ec6e5ee61662d42","sha512":"e197bdd471bf153be4ee6db4fa68bf514a23482237512750a00c50cde02f9b0cacf1f3d99265fdc84c8ce5feed86e97ea167e108c1fe8fd04e7ed36d1efcf8d9","ssdeep":"","tlshash":"e51116ad8355030c9373d3605bb2c6b0775a80f16a875afd75f112506d88db68360d8d","first_seen":"2025-02-27T14:01:14.509299Z","last_seen":"2026-08-09T18:47:26.989694Z","times_seen":598,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"wrth.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.bunny.net/roboto/files/roboto-latin-900-normal.woff2","fqdn":"fonts.bunny.net","domain":"bunny.net","tld":"net"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://wrth.info/","date":"2026-03-24T01:57:32.132Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fonts.bunny.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 21 Feb 2026 03:04:21 GMT","end":"Fri, 22 May 2026 03:04:20 GMT"},"fingerprint":{"sha1":"4B:2A:86:15:05:FF:29:84:62:F8:36:DC:E9:F9:21:E0:E0:25:D6:B7","sha256":"DF:9D:6C:C0:B2:8C:6F:83:63:FA:A4:69:D0:8C:35:1D:15:3D:19:AF:3F:15:46:FF:C6:C1:B1:20:89:A9:CD:CF"}}},"request":{"raw":"GET /roboto/files/roboto-latin-900-normal.woff2 HTTP/1.1\r\nHost: fonts.bunny.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://wrth.info\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.bunny.net/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 24 Mar 2026 01:57:32 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 21916\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 781720\r\ncdn-requestcountrycode: NO\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\naccess-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\ncache-control: public, max-age=2592000\r\netag: \"69aaa9ca-559c\"\r\nlast-modified: Fri, 06 Mar 2026 10:17:46 GMT\r\ncdn-storageserver: SE-583\r\ncdn-fileserver: 318\r\ncdn-proxyver: 1.43\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 03/07/2026 15:27:12\r\ncdn-edgestorageid: 830\r\ncdn-requestid: cac7951f8509a75775bbc176b66909bc\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":21916,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 21916, version 1.0","md5":"c1a67fffb17b2151e0b28a8acbc60deb","sha1":"ecaeca524756eef1a1e6cf4165f80f47c7e71a49","sha256":"7523c0cc7f5c088ab663be51e111b9429a4f15681802a7e027eb658f497a26a8","sha512":"74f9faf1db9df68f82e4a0c16ab3bdd93fb4fcefa619aa98f59f779922554ab666b02782f8a43cffef2f120fd3e145900f84eb5f0820b4b39a35418e49eb6183","ssdeep":"384:Ov2C1MNF7DsRoI/JR7YRHBV2IpVRgZdNtBA9wTEDeYjTJQvhi6g+E0ex29rIYq+5:sx1Mn7D72JJKV2IP4brnxqPt2Nrq78h","tlshash":"c7a2e162e7da42ef03de09ba0135162977f32e1cc69f15f1501103e869a3929b91f96f","first_seen":"2026-02-20T01:46:04.632895Z","last_seen":"2026-08-09T18:47:27.001591Z","times_seen":716,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":40,"dns":1,"connect":17,"send":0,"wait":18,"receive":19,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wrth.info/","fqdn":"wrth.info","domain":"wrth.info","tld":"info"},"ip":{"addr":"217.160.0.155","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-24T01:57:31.176Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.wrth.info","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 20 Mar 2026 00:00:00 GMT","end":"Wed, 16 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D2:47:4B:4E:04:EB:81:59:92:E2:B0:1C:80:B1:2D:CC:F1:93:E6:86","sha256":"25:FE:C4:0E:E2:82:1A:42:DC:79:77:76:B7:DC:1A:17:60:97:87:ED:6A:56:29:AB:17:29:E9:28:70:7B:2D:3A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: wrth.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\nx-ws-origin: available\r\nx-ws-ratelimit-limit: 1000\r\nx-ws-ratelimit-remaining: 999\r\ndate: Tue, 24 Mar 2026 01:57:31 GMT\r\nserver: Apache\r\nx-powered-by: PHP/8.3.30\r\nretry-after: 86400\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP:8.3.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]}],"data":{"size":2204,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"dc9ff00eac0eb7574968f30529579ff5","sha1":"db4401abe0fde8519188abb8da96cc7882b2ee1e","sha256":"b6ed2a56a51c2a81379dc42fa36a368bc5d57e2e34e0d49dcfaaa31113705962","sha512":"0a9acbfa050027ee4e855562c5892abee494383f2911fa019b8b3214e507c5ff4d6e577a64daebec6813cfe8abe58071d5e8194d775ddf0534d3ec679025f70e","ssdeep":"","tlshash":"5441433310956913623682a5f451764ceb898297e62ec982f1ec056f4ff1f52cc6f708","first_seen":"2026-03-24T01:57:54.973373Z","last_seen":"2026-03-24T01:57:54.973373Z","times_seen":1,"resource_available":false,"data":null}},"time_used":946,"timings":{"blocked":343,"dns":43,"connect":37,"send":0,"wait":258,"receive":0,"ssl":262},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"wrth.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wrth.info/wp-content/plugins/under-construction-page/themes/css/bootstrap.min.css?v=4.04","fqdn":"wrth.info","domain":"wrth.info","tld":"info"},"ip":{"addr":"217.160.0.155","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wrth.info/","date":"2026-03-24T01:57:31.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.wrth.info","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 20 Mar 2026 00:00:00 GMT","end":"Wed, 16 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D2:47:4B:4E:04:EB:81:59:92:E2:B0:1C:80:B1:2D:CC:F1:93:E6:86","sha256":"25:FE:C4:0E:E2:82:1A:42:DC:79:77:76:B7:DC:1A:17:60:97:87:ED:6A:56:29:AB:17:29:E9:28:70:7B:2D:3A"}}},"request":{"raw":"GET /wp-content/plugins/under-construction-page/themes/css/bootstrap.min.css?v=4.04 HTTP/1.1\r\nHost: wrth.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wrth.info/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css\r\ncontent-length: 25197\r\nx-ws-origin: available\r\nx-ws-ratelimit-limit: 1000\r\nx-ws-ratelimit-remaining: 998\r\ndate: Tue, 24 Mar 2026 01:57:31 GMT\r\nserver: Apache\r\nlast-modified: Sun, 22 Mar 2026 13:21:41 GMT\r\netag: \"1d970-64d9ccc846cb6-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=2419200\r\nexpires: Tue, 21 Apr 2026 01:57:31 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":121200,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65371)","md5":"ec3bb52a00e176a7181d454dffaea219","sha1":"6527d8bf3e1e9368bab8c7b60f56bc01fa3afd68","sha256":"f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c","sha512":"e8c5daf01eae68ed7c1e277a6e544c7ad108a0fa877fb531d6d9f2210769b7da88e4e002c7b0be3b72154ebf7cbf01a795c8342ce2dad368bd6351e956195f8b","ssdeep":"768:Vy3Gxw/Vc/QWlJxtQOIuiHlq5mzI4X8OAduFKbv2ctg2Bd8JP7ecQVvH1FS:nw/a1fIuiHlq5mN8lDbNmPbh","tlshash":"2cc3c7a0f21031ea7333c55a75d0ed872219a153e56a4fb7f22f25d88f845ca1673f1a","first_seen":"2023-04-05T03:13:25Z","last_seen":"2026-08-09T22:58:32.510697Z","times_seen":72677,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"wrth.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wrth.info/wp-content/plugins/under-construction-page/themes/mad_designer/style.css?v=4.04","fqdn":"wrth.info","domain":"wrth.info","tld":"info"},"ip":{"addr":"217.160.0.155","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wrth.info/","date":"2026-03-24T01:57:31.947Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.wrth.info","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 20 Mar 2026 00:00:00 GMT","end":"Wed, 16 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D2:47:4B:4E:04:EB:81:59:92:E2:B0:1C:80:B1:2D:CC:F1:93:E6:86","sha256":"25:FE:C4:0E:E2:82:1A:42:DC:79:77:76:B7:DC:1A:17:60:97:87:ED:6A:56:29:AB:17:29:E9:28:70:7B:2D:3A"}}},"request":{"raw":"GET /wp-content/plugins/under-construction-page/themes/mad_designer/style.css?v=4.04 HTTP/1.1\r\nHost: wrth.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wrth.info/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css\r\ncontent-length: 746\r\nx-ws-origin: available\r\nx-ws-ratelimit-limit: 1000\r\nx-ws-ratelimit-remaining: 996\r\ndate: Tue, 24 Mar 2026 01:57:31 GMT\r\nserver: Apache\r\nlast-modified: Sun, 22 Mar 2026 13:21:41 GMT\r\netag: \"640-64d9ccc84ab36-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=2419200\r\nexpires: Tue, 21 Apr 2026 01:57:31 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1600,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"2676225b7513d53ace18af648784271c","sha1":"acd884be8efcf8824c37f262c82fa7c1769c42c9","sha256":"ecb99dc726c64602ffe6ce81d5e41f817fb332e7b39858ba35ac4a71d16e633b","sha512":"a11ec49b3c90ec18db5992c4eec41b4c73519d1f3ddab9fe410ba35f98aa5a11c09d0d2f1e232843a93c95965a06654bc38edb18a264bf447bbd55f5f523a951","ssdeep":"","tlshash":"5d31555b86529100f33bc8f173f21a31ea588c27974756f9b99032a9f480d9042b8fcc","first_seen":"2025-04-19T21:40:03.660042Z","last_seen":"2026-08-09T18:47:26.999419Z","times_seen":268,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"wrth.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wrth.info/wp-content/plugins/under-construction-page/themes/mad_designer/mad-designer.png","fqdn":"wrth.info","domain":"wrth.info","tld":"info"},"ip":{"addr":"217.160.0.155","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wrth.info/","date":"2026-03-24T01:57:31.952Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.wrth.info","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 20 Mar 2026 00:00:00 GMT","end":"Wed, 16 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D2:47:4B:4E:04:EB:81:59:92:E2:B0:1C:80:B1:2D:CC:F1:93:E6:86","sha256":"25:FE:C4:0E:E2:82:1A:42:DC:79:77:76:B7:DC:1A:17:60:97:87:ED:6A:56:29:AB:17:29:E9:28:70:7B:2D:3A"}}},"request":{"raw":"GET /wp-content/plugins/under-construction-page/themes/mad_designer/mad-designer.png HTTP/1.1\r\nHost: wrth.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wrth.info/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 161836\r\nx-ws-origin: available\r\nx-ws-ratelimit-limit: 1000\r\nx-ws-ratelimit-remaining: 994\r\ndate: Tue, 24 Mar 2026 01:57:31 GMT\r\nserver: Apache\r\nlast-modified: Sun, 22 Mar 2026 13:21:41 GMT\r\netag: \"2782c-64d9ccc84ab36\"\r\naccept-ranges: bytes\r\ncache-control: max-age=2419200\r\nexpires: Tue, 21 Apr 2026 01:57:31 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":161836,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 691, 8-bit/color RGBA, non-interlaced","md5":"ae7ef1d8f209071bdaab1d8ab360d446","sha1":"39e52ff152dc6b184680b7c80d0debb3cdb7e35e","sha256":"4fdaf9964919c37134c8d9ab4e1f5330f263967c59ee8d8e8346ae84479a3efb","sha512":"e2321b04460df3a367697c5b9ad9c02904983f9a80850fc2f2ac19a3fe324003274a28d45805069a9c4ddd6f7d33f3d9463e0c2df0a2e563551995783fc7090a","ssdeep":"3072:mp6Kt1J3eCTZ00E88O4TOBzwj1hyWI/mNihJoaLzgYC:X43eC10fBTEEhhI/mNiheYC","tlshash":"c8f312a27e37f4e8ccafeab145022e46a53b094355c02e35f9fd5c6d1f14e6299c2c60","first_seen":"2023-05-02T11:21:38Z","last_seen":"2026-08-08T23:07:14.530504Z","times_seen":604,"resource_available":false,"data":null}},"time_used":161,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":86,"receive":75,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"wrth.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wrth.info/wp-content/plugins/under-construction-page/themes/css/font-awesome.min.css?v=4.04","fqdn":"wrth.info","domain":"wrth.info","tld":"info"},"ip":{"addr":"217.160.0.155","port":443,"asn":8560,"as":"IONOS SE","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wrth.info/","date":"2026-03-24T01:57:31.949Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.wrth.info","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 20 Mar 2026 00:00:00 GMT","end":"Wed, 16 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D2:47:4B:4E:04:EB:81:59:92:E2:B0:1C:80:B1:2D:CC:F1:93:E6:86","sha256":"25:FE:C4:0E:E2:82:1A:42:DC:79:77:76:B7:DC:1A:17:60:97:87:ED:6A:56:29:AB:17:29:E9:28:70:7B:2D:3A"}}},"request":{"raw":"GET /wp-content/plugins/under-construction-page/themes/css/font-awesome.min.css?v=4.04 HTTP/1.1\r\nHost: wrth.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wrth.info/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css\r\ncontent-length: 7930\r\nx-ws-origin: available\r\nx-ws-ratelimit-limit: 1000\r\nx-ws-ratelimit-remaining: 995\r\ndate: Tue, 24 Mar 2026 01:57:31 GMT\r\nserver: Apache\r\nlast-modified: Sun, 22 Mar 2026 13:21:41 GMT\r\netag: \"7918-64d9ccc846cb6-gzip\"\r\naccept-ranges: bytes\r\ncache-control: max-age=2419200\r\nexpires: Tue, 21 Apr 2026 01:57:31 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":31000,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (30837)","md5":"269550530cc127b6aa5a35925a7de6ce","sha1":"512c7d79033e3028a9be61b540cf1a6870c896f8","sha256":"799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd","sha512":"49f4e24e55fa924faa8ad7debe5ffb2e26d439e25696df6b6f20e7f766b50ea58ec3dbd61b6305a1acacd2c80e6e659accee4140f885b9c9e71008e9001fbf4b","ssdeep":"384:wHu5yWeTUKW+KlkJ5de2UYDyVfwYUas2l8yQ/8dwmaU8G:wwlr+Klk3Yi+fwYUf2l8yQ/e9vf","tlshash":"78d241e8e54c01d66731c48bff81b36862b6fb3dd5854da9f01f290c29d226522c5fba","first_seen":"2023-04-05T03:13:25Z","last_seen":"2026-08-09T22:50:29.732537Z","times_seen":307444,"resource_available":true,"data":null}},"time_used":165,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-03-24","alert":"Sinkholed","trigger":"wrth.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-24","alert":"Phishing Block","trigger":"wrth.info","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}