{"report_id":"03e694fe-f648-4bef-b963-672ebb6c23a6","version":0,"status":"done","tags":[],"date":"2026-08-08T01:02:57Z","url":{"schema":"http","addr":"am.nrwhl.lol/","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"172.67.178.244","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"am.nrwhl.lol/#/login","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"title":"Inloggen | AMAZON","dom":{"size":990736,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (65536), with no line terminators","md5":"f7a4fdc3bf1599f8ed739a9eadc205e6","sha1":"c65b58fa9d34b6af672ea7ef22ad9498bf08ab80","sha256":"1ea9e7333bc0531e0771d2698ffc11a9d1cebae0a9c0caa3f4ba2a4b12c558df","sha512":"6b7463ee762ac40db8080628171d51382605a5014900b7c4a48ecb6d87595c345fd9bfc5d05b11f466a2ae28e7169da270adeb46437f29a00454573558611102","ssdeep":"6144:FwGNN+yChEEuiEoHhgr91EmRv2OQYFUnmCE1vS13xn3rapidW/wwWI4t/i:LCXHhgZ19Rv2OBiRi","tlshash":"1b25c6d4a724627c488e83deb639b024761e54ef7ad1cdb8957cce9006a359dcd82ccb","dom_hash":"domhash135bb3be5b0a634daa54f9927d7717d3","first_seen":"2026-08-08T00:58:45.110036Z","last_seen":"2026-08-08T01:31:50.857559Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"am.nrwhl.lol/","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"172.67.178.244","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-12T01:02:57Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"am.nrwhl.lol","ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-08-03","domain_rank":0,"first_seen":"2026-08-08T00:58:38.601373Z","last_seen":"2026-08-08T00:58:38.601373Z","alert_count":80,"request_count":40,"received_data":2188349,"sent_data":18678,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-CAKy-Pee.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"262056b0412710c089d3b7427f3a7597","sha1":"1c3a8d988f4f70181f2d63ce89e0f82093544a85","sha256":"412560e19a132638b05d274e311a1e863d1de6c02f14ef691fcbb6fa25d24a94","sha512":"7587d0d94d52962a1bf9308b9cbaff95cfc22cb559e9ea59d26257b7518f89d633ca29d88ede848afc5e43265f003fc014b2f5d80a02f196085a19bdc85e6080","ssdeep":"","tlshash":"12315751fcd8b57013939dc8c16e48919b48165bae6cd6e1f07b7c902b7058de578f1c","size":1865,"data":"","first_seen":"2026-07-26T12:43:49.07874Z","last_seen":"2026-08-08T01:31:50.940745Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-OWBrqJHp.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5c31850df215f8990a782b3839720139","sha1":"46061f5178f7db3bf9c254dde13cb04bf58f0219","sha256":"0f878a906163c76e28175d82d634a0761763cee6602a06476d0bbc03b55c52f9","sha512":"0415d4e5b36fd06b3a2acd49215a0767913fd4c057fa61d5b8521a6ce4f5d7e24e324383bf5fd760ad8557e6e33c4355a69e149fb57d674b0d84ed7900842edf","ssdeep":"","tlshash":"4141666d79c89078dbbbd88c90320506f91b5b191634adf1e0ee5d6c2e37508e13be35","size":1976,"data":"","first_seen":"2026-07-26T12:43:48.93261Z","last_seen":"2026-08-08T01:31:50.954434Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/indexAmazon-YOtfevGs.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9941847841225604a992db88d24cfd5e","sha1":"39da2673ea0463709e37f2e6da9d77d2932ba4f5","sha256":"52d8730c7a6f4e37ebf35d4d0688b60ee62a109ea7b16d1f0b28742bbb6f9d23","sha512":"648ff4afa9d702b06573794e210e09a10d2ee9bf706e212eaa2afb469ca63bf2b8caff848c97dfedfd243f5a5bbbd38c1aabdf60a797ebb576d7804d45b485d7","ssdeep":"","tlshash":"7711e1cc6f2e8ff46f0b4c5c2094c4d16b9eb6d649a52680ce4dcc4da2114eda0af314","size":991,"data":"","first_seen":"2026-07-26T12:43:49.175773Z","last_seen":"2026-08-08T01:31:50.934562Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/use-id-CxS7hwyO.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8bb7c035118177fdf58bd521e41108c8","sha1":"f82a24a3b71574895030a9cff73a354d73303110","sha256":"181345d7b4e36a41a1e2e38f3040c4c4ab6947eb03258f3c6983cd87b27ef826","sha512":"aebd40d85482c64bc56d1640f5582ad29ebae083c96c31db429f483e4ff981dc81a1855921c9f583591a1550b7d72f35ad74aa39f8f271e058ac19385d4355de","ssdeep":"","tlshash":"21c0cc2e380200b0f20c0002a02b0b00e33e30222b0b0a80f2820b2300b28828bfef28","size":167,"data":"","first_seen":"2026-07-26T12:43:49.155138Z","last_seen":"2026-08-08T01:31:50.983878Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"cd7a34e714de94d5c29b8ac5acdde24b","sha1":"b722bccb435490630d97ef88cafeb02d92f70fd0","sha256":"312ebfdc50a0e168cff60c206811b02e944263a7d9060c2685509dacfacd7f71","sha512":"a724bc648a508c24e5bb1788e1f02b47030893bbb0b80a99e380d95480095983a35d8ec11193c53f0a67db47a289ab608fcbc9dbca846bfdd5d61a8832290f43","ssdeep":"","tlshash":"58e07d48ff28c7f316ce28ab516e770858d104d58c1b58024cebccc86935ed87291527","size":314,"data":"","first_seen":"2023-03-11T11:23:25Z","last_seen":"2026-08-14T04:28:06.507274Z","times_seen":41413,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"528dd01eb509d1fc3c68b48e165c9d77","sha1":"8d702f33d869eb8c53cf75c17014f96385322395","sha256":"b508dff20bdbd9138e31aa48c45bc501805e509d2fd4709b39c4a60cd5c6b43a","sha512":"4c1edeec560f431005363ff5291acc80c1c42edf7c9a6d6e4fde2f7539b6a35a8e36f0bc228503263277bf5df4525dc579575faadca614c32e5dfa885a2d343b","ssdeep":"","tlshash":"78a012bb71b851710cd51ba7a40455e01c20123105052c101c8d5151c011c171d394c0","size":84,"data":"","first_seen":"2023-04-07T06:55:59Z","last_seen":"2026-08-14T04:28:06.508353Z","times_seen":42878,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-aRx2OawA.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f9093bf15f3d0a5279a829bb5f949a4b","sha1":"1d5ee67a3f3d81804be6229244573c7f8cf0783e","sha256":"24b9c183a9b61d122fd41cc8d0214a0186d3086bf5e6d50cbbfb924fe3fa94c2","sha512":"9612c424246494210584f410f1478386acb4c44beba773dd21698021e50bc6c5ff2ebb2b2fe48878a8ec81bd30ad5d6cf718155be4842da94022a5d1ff42fa0a","ssdeep":"384:eVmCQUF9d9P4YX1VRjJVIKGbTNdqqVi4IqxK4eFbqmNqa5:eMCQgD1XlMTNdqqA4Iq44eRq6r5","tlshash":"e6527d2de515c5fdc48704b85a4f44d27c0d6dfee378a509eb6eaa121b93c2c651fb20","size":13858,"data":"","first_seen":"2026-07-26T12:43:49.117386Z","last_seen":"2026-08-08T01:31:50.937871Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-CfgYFPgw.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"145294516c9070938e877ca2d99a79cb","sha1":"8da6f85ddfac4faa3ddb795f340cf50ff23927b6","sha256":"f56084bf1b4feaaebc7edcc747ccd0d752b604484e6c1ad78d4d291799b391ef","sha512":"f866b615152600c68408bc4d77bded1697084cc3efa590a34c4c07d6b56718c97232cbe1b3ca41fea887675005316cf2666dc423fb71ac86a8f786a2615333d7","ssdeep":"","tlshash":"2e3196a6f8f4de79a5bb1ac0722b0025996f07a8a56140f2f6ef07041b7c8d4d89fd5c","size":1795,"data":"","first_seen":"2026-07-26T12:43:49.092852Z","last_seen":"2026-08-08T01:31:50.930425Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/general-D6Z7Ijj1.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5894303eb9adfea6b272462f07d5bcb0","sha1":"495b6023535aec7731f8aff81003170aaf73ff9e","sha256":"488b5cf4242e7a27b0d644449010cfc87299f9dee7218c8e2230772aa623557b","sha512":"9bdbc2231c55284a349981cda60ee06b180e91588f3fb85e8f3d9a6422e011668745657087f8db34c40c0c74653785f1729657e89625183371a5e3c3ba8a9919","ssdeep":"","tlshash":"d9d02e6b2aa2ecf0a248c00490ae680693bac4c8a12e00417c1200cf2af06b8967f44c","size":249,"data":"","first_seen":"2026-07-26T12:43:49.168139Z","last_seen":"2026-08-08T01:31:50.938859Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-D1or5p_0.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d58d8a7fc34c93ead93d15dbd4ca772c","sha1":"d70fd4523578aa32613d0e2ef8c4099d869de4e0","sha256":"f41967ad5cb0ce22bac7af5a7aa90c259eca5f0658ae36ed903ac87c652f8776","sha512":"0bbe130a6b9ccdba7f252ab46b9666756bf4ab1ff55c26cd4da70da7713858f1c4da5afd3a8ec2832742aa66efd32b9ba6939e6ef860735071828029b3d9cc60","ssdeep":"","tlshash":"ee31738b2ec817720c0798fde11aa052a57d1a1c3c5051e0c059bd1a616ffc4eaabd1c","size":1815,"data":"","first_seen":"2026-07-26T12:43:49.041378Z","last_seen":"2026-08-08T01:31:50.985659Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/jsencrypt-B3YSpQTJ.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"964e4e4a69bb9657334858fd83c05313","sha1":"df7a1b45fd2aea42ae580c9448ba0f651fbee04f","sha256":"e105c23feadd44d9aebb41c0f8ea06896d95296454eead53cd6b07f25a294631","sha512":"ec9614fcb6879e6c6ddabadf6bef440be5fcce76d4eb1fb489c9c0ebbba30a28f6c1574e47c7e53945d77e52d0a44c3382a0d6e69102f947cdddf7d4bba1ea39","ssdeep":"1536:+6w122LcoS6YxwVTotuPpYiGRPhOgPzU13oyNool:Vw122NwxwxotuPpYiGRP8gPzY3oyNool","tlshash":"9b43d8c972e674a503d6e0b0062f0546e23fb61d591e90bcfa59c8f2acb4d49513bf78","size":58024,"data":"","first_seen":"2026-07-26T12:43:49.007082Z","last_seen":"2026-08-08T01:31:50.984796Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/polyfills-C99L_pqp.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"119786325b9084b364895b7d7884347f","sha1":"565b982f4bc612bebf0bb137f012cf1b9d624c35","sha256":"99823f983075ce0322f39a4cb58544bc69502ac7d8f3faa845f3b7ceb543e773","sha512":"679c8d9d7c8448b757872fd31c169b951eb5fd070bd0c25ca8e5c2283c5dd32c719e5cd4cc7b17d3d19d3e3b26887045db07bc56e1749dad62458656d30d7da0","ssdeep":"1536:mKKTqvzfT0PYi8i+IrnWvQmfDymutTHk1y9qaA:mKYqvsPTrnWImfDypTHk1y9rA","tlshash":"53a3e6c9f6c6f0a243e760a4403f510bf23b6d55b80e8194e762d1d17cb9a8ac17bf69","size":106525,"data":"","first_seen":"2026-07-26T12:43:49.108869Z","last_seen":"2026-08-08T01:31:50.95247Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-DfUW_fvn.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8c29fa12b6d261707a909b6deb816986","sha1":"f1e302ad83bf334fe1a4fdc8c3f4fe81c4fddefe","sha256":"fea1f371ff8c36b739687db891da2ea5f911ff69305005ffeccd1bda3a5037f4","sha512":"852e783084d6213e3751ce5798018ad7818c9c6121ce7a756b9f85ec28325d539f4402fd5aaa346b382b0dda8164d91575f1245e104e892c4b823966c45ec132","ssdeep":"24576:4qIB39amBxInJ9yeV+lT0qNBaqezczJTNREWh1VV3k/4O3+olHhg9iUbn2pOgW:4qIB399BxInJ9yeV+lT0qNBaqezczJTx","tlshash":"89655dd5a720227c498a83de7539b024722e48eb36c5ccf4e57cce9516b389ec987d87","size":1525406,"data":"","first_seen":"2026-07-26T12:43:49.186613Z","last_seen":"2026-08-08T01:31:50.988535Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/Goods-gAwAIAw3.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e4275e9cb2d2e3586d9e4ebf792715ff","sha1":"9495e40bbea2770b100e5ee0d387cd0e18b8bac4","sha256":"e557f83ba84008dec7dfd948c0ab444cbcd0ab5f47656709f3d1f681705b4e1e","sha512":"f3040638d1446267a01ba0b9a0e9647b44f8100a78af72dd8d423d7a11f723090bef2c45cf2d01e1dd4c5134155de83775fbdd731c4e7b6c8691c04f78b78c27","ssdeep":"","tlshash":"b011808d6781fc657559415364ae542b52fd4e8bc63c5824fc8b4fcd289843d933d41c","size":877,"data":"","first_seen":"2026-07-26T12:43:49.044398Z","last_seen":"2026-08-08T01:31:50.95583Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-Dp5wmByz.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a687bbd4b398852597765056844278c4","sha1":"5f11009ca5343521d0fce43fce6b3aa5d840f126","sha256":"647252bae3b64e16cd39c478e75982bbd78c79087413c4e3204ddcb8c622c6a7","sha512":"2a4b0a97727653fd9d011aaa478ac870a16dc5adb7bebd7cb7ba0c7ca2045a086f541bda60c73f3749d92c968c1aca743e2a0df0b739ae4e605cd1b3bb1e0ea3","ssdeep":"","tlshash":"b261b42cf6558ef4a67345d868170020710e993f4134cb45e2be4f983a92ed2d66e33f","size":3392,"data":"","first_seen":"2026-07-26T12:43:49.054535Z","last_seen":"2026-08-08T01:31:50.957269Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-BaGc4iDU.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"855128e24c45b7711eb0e923b4366e89","sha1":"2ca7da41635a451abd8b94e6c37345dcab14015f","sha256":"d47c902f23643185bb56855643fe09cef54050d6f7d420d1120d8bd01f5fba20","sha512":"8a77db4a50762f69a9b2e0c1ffa2e9e9012a6ef95d4d0afdfe44d2cdada513cf553b55fac542c6a04318ec6d6a6ec420183132b6b3c528de4a0a34f6d83be22d","ssdeep":"192:3jNUPlklkoA8n8I3VAo5mWKbm40SASbcAGk5LJ/qupg2Af:3jzl9A8nF3Go5mWy0SASbczk5V/qumT","tlshash":"0002d6c9b0a6aa724bbb1895f0e74151a95d5b48b01794d1f02f9c003befec0a679f2d","size":8349,"data":"","first_seen":"2026-07-26T12:43:48.946117Z","last_seen":"2026-08-08T01:31:50.949814Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/PrivateMessage-BiiDLqFa.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a5aa867b79a29d921935efd1a2a9fd74","sha1":"42bcce01f95016bc4e5301f7e8825641567435c4","sha256":"9f282902d2966456b781b9094b56a9844329d8dfbf58679f7f92c4f1ddc1406d","sha512":"bdfc8e7a5613b1dfe51a8045b25182807155c257b7163d19930dcbb4fb8f6182ee51ca05b132f2e7fd7155ed1d697f6ce35845091d4f894e9c8b43e088d1c09a","ssdeep":"","tlshash":"e75196ab781c8d3ab33b09a0909100507b1e4fed7125ade1bc0d5b1606f6eb0e9cf71a","size":3157,"data":"","first_seen":"2026-07-26T12:43:48.975246Z","last_seen":"2026-08-08T01:31:50.958613Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/GoodsItem-BfoPiHFW.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e6a18023a87ac21857bb9badaf8390c6","sha1":"fc1857325c0e83c7057e77b914f79a183b5c4415","sha256":"239e1d184e9c88ae1d8a82a15f67535fffb4f7a339fa13d7e6cbd01246babebb","sha512":"240d0ad068ad6bc452a7b6974707d7e87fa78b1fa4a5ba057f00b35fc21928334623261e89cdb7939dc4464372d2956a19f37cdb7364ce57707ab5ee8195f246","ssdeep":"","tlshash":"2501d08dd44eefb442d344c8326b111476d82da9e6345cc8b9e696221b6f83cb239530","size":789,"data":"","first_seen":"2026-07-26T12:43:49.130793Z","last_seen":"2026-08-08T01:31:50.978928Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"Load Language：en_US","filename":"https://am.nrwhl.lol/static/js/index-DfUW_fvn.js","line_number":43,"column_number":76528},{"level":"log","text":"Load Language：nl-NL","filename":"https://am.nrwhl.lol/static/js/index-DfUW_fvn.js","line_number":43,"column_number":76528},{"level":"log","text":"have country code update","filename":"https://am.nrwhl.lol/static/js/index-DfUW_fvn.js","line_number":42,"column_number":27862},{"level":"log","text":"Interval:true","filename":"https://am.nrwhl.lol/static/js/index-DfUW_fvn.js","line_number":43,"column_number":73469},{"level":"log","text":"dialog,map[actor:server1.conn0.watcher16.process7//obj46 class:Object extensible:true frozen:false isError:false ownPropertyLength:4 preview:map[kind:Object ownProperties:map[code:map[configurable:true enumerable:true value:200 writable:true] msg:map[configurable:true enumerable:true value:SUCCESS writable:true] rows:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher16.process7//obj47 class:Array extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[kind:ArrayLike length:0] sealed:false type:object] writable:true] total:map[configurable:true enumerable:true value:0 writable:true]] ownPropertiesLength:4] sealed:false type:object]","filename":"https://am.nrwhl.lol/static/js/PrivateMessage-BiiDLqFa.js","line_number":1,"column_number":783},{"level":"log","text":"Load Language：nl-NL","filename":"https://am.nrwhl.lol/static/js/index-DfUW_fvn.js","line_number":43,"column_number":76528},{"level":"log","text":"Load Language：nl-NL","filename":"https://am.nrwhl.lol/static/js/index-DfUW_fvn.js","line_number":43,"column_number":76528},{"level":"log","text":"Load Language：nl-NL","filename":"https://am.nrwhl.lol/static/js/index-DfUW_fvn.js","line_number":43,"column_number":76528},{"level":"log","text":"have country code update","filename":"https://am.nrwhl.lol/static/js/index-DfUW_fvn.js","line_number":42,"column_number":27862}]},"http":[{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-aRx2OawA.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.702Z","timestamp":1786150951702,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/index-aRx2OawA.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-3622\"\r\npriority: u=1,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Fbs7qdHSmZZ4jvjoGTU08jyqfeLtZBEn5VbYpbUdjsMOwUQDgPR6wgJ6iPrWps83TDVvwlZXoImsebYrB9TMD6B39q3XVIdBhYQXygtoVA%2Bj%2FKQREdq7reIF8F%2BW9FY%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a989829270883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13858,"size_decoded":9713,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (13857)","md5":"f9093bf15f3d0a5279a829bb5f949a4b","sha1":"1d5ee67a3f3d81804be6229244573c7f8cf0783e","sha256":"24b9c183a9b61d122fd41cc8d0214a0186d3086bf5e6d50cbbfb924fe3fa94c2","sha512":"9612c424246494210584f410f1478386acb4c44beba773dd21698021e50bc6c5ff2ebb2b2fe48878a8ec81bd30ad5d6cf718155be4842da94022a5d1ff42fa0a","ssdeep":"384:eVmCQUF9d9P4YX1VRjJVIKGbTNdqqVi4IqxK4eFbqmNqa5:eMCQgD1XlMTNdqqA4Iq44eRq6r5","tlshash":"e6527d2de515c5fdc48704b85a4f44d27c0d6dfee378a509eb6eaa121b93c2c651fb20","first_seen":"2026-07-26T12:43:49.117386Z","last_seen":"2026-08-08T01:31:50.937871Z","times_seen":6,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/css/index-CjDbwX4t.css","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.718Z","timestamp":1786150951718,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/css/index-CjDbwX4t.css HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: text/css\r\netag: W/\"6a3cde4c-9d1\"\r\npriority: u=2,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cTxuA6ZaOM9OL%2Bcy41THexOT76JX8zzBR39aNW3A6rSF6XDKjJo%2Fz8VkXK7tRM5h999QDowfN5d0xNSjXBdJ9O3u%2Fh9gumpKXUIg9ZvnOicX7VQWQNldbNrgfrfrwZ0%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a9898392b0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2513,"size_decoded":1358,"mime_type":"text/css","magic":"ASCII text, with very long lines (2512)","md5":"8de4120e74cd75659fb3d6f099c4f624","sha1":"9ee1fe808943327edaed037ddedd22346d47f690","sha256":"1efbbfea80c5760b5dc1ef92c4f1452d2a7f206730f0d680cf4757eec58bad09","sha512":"5512287d287d0f974705d638058d198e00364baf9d80893dc67f9c767f8d1406be3fa14ed00608ee7eaa6a2ce8e68b19d51ede0e1365b8a0adc8d38b23674b25","ssdeep":"","tlshash":"0e5106776190323dff03f890836b76d9a238f433c91691e9a31053188bd7fe456a222e","first_seen":"2025-10-11T12:16:49.317901Z","last_seen":"2026-08-12T09:31:01.004631Z","times_seen":39,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/GoodsItem-BfoPiHFW.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.796Z","timestamp":1786150951796,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/GoodsItem-BfoPiHFW.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-315\"\r\npriority: u=1,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BfsGEU69eeLe%2BF6OnIzHlJuKmgDCEQZR%2FMlzJF4L0O5TVFqndsHPWTBLym6kYyhuFNEWCkwN13bN8m5pWCSXN6WY%2BbPYBeRGX2%2FoCdh5Jeb4WpoLG5uPg4y%2FZJLFocM%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a9898c93c0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":789,"size_decoded":1184,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (788)","md5":"e6a18023a87ac21857bb9badaf8390c6","sha1":"fc1857325c0e83c7057e77b914f79a183b5c4415","sha256":"239e1d184e9c88ae1d8a82a15f67535fffb4f7a339fa13d7e6cbd01246babebb","sha512":"240d0ad068ad6bc452a7b6974707d7e87fa78b1fa4a5ba057f00b35fc21928334623261e89cdb7939dc4464372d2956a19f37cdb7364ce57707ab5ee8195f246","ssdeep":"","tlshash":"2501d08dd44eefb442d344c8326b111476d82da9e6345cc8b9e696221b6f83cb239530","first_seen":"2026-07-26T12:43:49.130793Z","last_seen":"2026-08-08T01:31:50.978928Z","times_seen":6,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/api/languages/nl-NL","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:32.278Z","timestamp":1786150952278,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /api/languages/nl-NL HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nisToken: true\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:32 GMT\r\ncontent-type: application/json\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eL8xsxipY7IBuHKZp5GrBoG9S%2BmNdgwEqgibUakgNSRxW1avUWXhfXMFESTYnXBj9Gycq%2B8nrKhMI3wajvaPVdmQHg%2B2Y2wK0pIGgwJZb6JOez67p1lWaH0hU72Jsj0%3D\"}]}\r\npriority: u=3,i=?0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncf-ray: a27a989bb9840883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":38561,"size_decoded":15923,"mime_type":"application/json","magic":"JSON text data","md5":"992fa4713af396686c098f5515e7b9ec","sha1":"992202b8de732313d800539ae1d38bf37d19f995","sha256":"b1e68d7bfb218bda60d91675ead4c10a6ca355fff81f15ff203090ae83262610","sha512":"8536ea3a2f3a58568117e06f52290bd82880ab62e48b6fb071ffffffd16a532e93db374660da81b3fb3003a18c3ecf4979b9ccea455b1f81b74cb67bb900350d","ssdeep":"768:3E2Muk5sjibqfXZjxa/fbLqoexdb9i32N1dijjzBonrDrH20qcB6G:HMuk5sjibqxkuj9Bvn","tlshash":"6c031a07994a1d7f4bc783c1b8865d7e6afd0147d2e8816cc8cfca7c11ade88a1bb495","first_seen":"2026-07-26T12:43:49.047783Z","last_seen":"2026-08-08T01:31:50.904908Z","times_seen":6,"resource_available":false,"data":null}},"time_used":385,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":198,"receive":187,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/api/logout","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:32.485Z","timestamp":1786150952485,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"POST /api/logout HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://am.nrwhl.lol\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:32 GMT\r\ncontent-type: application/json;charset=utf-8\r\nserver-timing: cfExtPri\r\npriority: u=3,i=?0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://am.nrwhl.lol\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VKHV36mfR60pzvqz3PGTwmF3nZrK4CMSDB%2FGqIHPAM6C9M5D3cFTjTa5PHadcooWmYijU0kQMDkCZktIWmWOVSg41zyiSjt5JRRSCqvAMsw6Ds6XuTqCtJX1CeubcJU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27a989d09970883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 33\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33,"size_decoded":944,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"a71c90ab95c7aea35a5366a04724c3cf","sha1":"89ad22e24f083263e8907bebf81ab193182ba230","sha256":"5406df7bd9f22a333cdac175da070e5bc4cbd11975c8ffa857de88b008fb4231","sha512":"65db18c3518d07d52097ea01f511dda84ffe8a39ab422ff7310b6b770380d47d9545ea8ad7800dc026404555b72cd9453c3d569aea0a623b0e32798d3fb1d391","ssdeep":"","tlshash":"258000aa088ce3a3bca320b8220a220000a830802b30c30c8c2ec23800c82cb88008c8","first_seen":"2023-05-13T02:04:34Z","last_seen":"2026-08-12T09:31:01.022177Z","times_seen":51,"resource_available":false,"data":null}},"time_used":202,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":202,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/indexAmazon-YOtfevGs.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:33.674Z","timestamp":1786150953674,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/indexAmazon-YOtfevGs.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:33 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-3df\"\r\npriority: u=1,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fKlBAQRtOAQi2XcpKocG2sYfbdKwiJDNU%2Bxa7ulV%2FSr9KxY0n1mUGTtGvUW%2BJbOcUwUXypviZ0hu7WJQBlesOrvOpq80VvQMO%2BMY5Esy5AENCab7dGq%2FqbvsMPTEKJg%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a98a47a670883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":991,"size_decoded":1235,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (990)","md5":"9941847841225604a992db88d24cfd5e","sha1":"39da2673ea0463709e37f2e6da9d77d2932ba4f5","sha256":"52d8730c7a6f4e37ebf35d4d0688b60ee62a109ea7b16d1f0b28742bbb6f9d23","sha512":"648ff4afa9d702b06573794e210e09a10d2ee9bf706e212eaa2afb469ca63bf2b8caff848c97dfedfd243f5a5bbbd38c1aabdf60a797ebb576d7804d45b485d7","ssdeep":"","tlshash":"7711e1cc6f2e8ff46f0b4c5c2094c4d16b9eb6d649a52680ce4dcc4da2114eda0af314","first_seen":"2026-07-26T12:43:49.175773Z","last_seen":"2026-08-08T01:31:50.934562Z","times_seen":6,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/use-id-CxS7hwyO.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:33.688Z","timestamp":1786150953688,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/use-id-CxS7hwyO.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:33 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-a7\"\r\npriority: u=1,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ckDugUuoGJ98W54u8o87ouz7SL%2FTgx5Hfj5n852XTgOfKjdCI5Qb4qTZ4pJnNeauJAztJAT6InhatBWcYQ8yPETU7N%2BwfrHr15GLYxlUscIIFJmP1qqwVhjL8B2UPsk%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a98a48a6e0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":167,"size_decoded":839,"mime_type":"application/javascript","magic":"Java source, ASCII text","md5":"8bb7c035118177fdf58bd521e41108c8","sha1":"f82a24a3b71574895030a9cff73a354d73303110","sha256":"181345d7b4e36a41a1e2e38f3040c4c4ab6947eb03258f3c6983cd87b27ef826","sha512":"aebd40d85482c64bc56d1640f5582ad29ebae083c96c31db429f483e4ff981dc81a1855921c9f583591a1550b7d72f35ad74aa39f8f271e058ac19385d4355de","ssdeep":"","tlshash":"21c0cc2e380200b0f20c0002a02b0b00e33e30222b0b0a80f2820b2300b28828bfef28","first_seen":"2026-07-26T12:43:49.155138Z","last_seen":"2026-08-08T01:31:50.983878Z","times_seen":6,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/api/languages/en_US","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.104Z","timestamp":1786150951104,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /api/languages/en_US HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nisToken: true\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: application/json\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZdImZE04zcsmidNCbfocPYjOASh9iSf8%2FZt0Q05CPXOYlNZy6Y5LBwb46urRkBmqUjjVkEf%2FUG2pm2cYXN9Y5FQoCpbgwCpw7nI%2FEim1HBycZA4NJBPokJhpEz5cpy4%3D\"}]}\r\npriority: u=3,i=?0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncf-ray: a27a989468e40883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":38561,"size_decoded":16236,"mime_type":"application/json","magic":"JSON text data","md5":"992fa4713af396686c098f5515e7b9ec","sha1":"992202b8de732313d800539ae1d38bf37d19f995","sha256":"b1e68d7bfb218bda60d91675ead4c10a6ca355fff81f15ff203090ae83262610","sha512":"8536ea3a2f3a58568117e06f52290bd82880ab62e48b6fb071ffffffd16a532e93db374660da81b3fb3003a18c3ecf4979b9ccea455b1f81b74cb67bb900350d","ssdeep":"768:3E2Muk5sjibqfXZjxa/fbLqoexdb9i32N1dijjzBonrDrH20qcB6G:HMuk5sjibqxkuj9Bvn","tlshash":"6c031a07994a1d7f4bc783c1b8865d7e6afd0147d2e8816cc8cfca7c11ade88a1bb495","first_seen":"2026-07-26T12:43:49.047783Z","last_seen":"2026-08-08T01:31:50.904908Z","times_seen":6,"resource_available":false,"data":null}},"time_used":580,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":391,"receive":189,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/apple-touch-icon.png","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.206Z","timestamp":1786150951206,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: text/html\r\ncontent-encoding: zstd\r\npriority: u=6,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PS9%2Fyi2McvdWsWOcY2trGH830nAWw62SF%2FvN8Qh9aCM027OlbZjGfemh20g86KUncQ4MHWhlzVqVpZuHIe5swcWVpf%2BGN26MhSSKhofy%2BKTK4QgCPO%2BqfeP6Zu2ybfk%3D\"}]}\r\ncache-control: private, no-store, no-cache, must-revalidate, proxy-revalidate\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: BYPASS\r\ncf-ray: a27a989508f00883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4363,"size_decoded":2154,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (4363), with no line terminators","md5":"b1459465dee7759edfab21be99d0498e","sha1":"3f43712896874883ebd32c1602dd654671bc1120","sha256":"ceeda9a581da31a93a7f335834aa014e28268a53d5144e9522cade26465ef4e2","sha512":"1ce58a075ed99a8384b7fc1df5d7830700da46d376a4ff300cf23891e42f7d80d861e9db5be1f32a7d339416ba74f4f46efb11c4c492dd8c525f266ea7b2602a","ssdeep":"96:BJHZLzZhCZydHRH/pW7AnqBAngzVkK7uB1piHliH3H/4:BfGZCxfueK7uB1piFiXf4","tlshash":"f8913256edb8d9b3c723d92775a8504084a04cb3eb171040b2e724e8de91f6a5b1c8eb","first_seen":"2026-07-26T12:43:48.949624Z","last_seen":"2026-08-08T01:31:50.897884Z","times_seen":6,"resource_available":true,"data":null}},"time_used":378,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":378,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/favicon.ico","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.208Z","timestamp":1786150951208,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: image/x-icon\r\netag: W/\"6a3cde31-10be\"\r\npriority: u=6,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:17 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8tY9imP4bsuqivNY9JjxMbp3YO%2Bh99Xp5m2dnR5N71L1NgP82de5qEnTPlPEIsEeu0iox%2BSd%2FK%2BljjsutzeBo4OVY3e%2FFRW3Hd8Sfzznu8pZiieBS0vH%2BjS1oSctg%2F0%3D\"}]}\r\nage: 263\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a989508f10883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4286,"size_decoded":1661,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"3cd761f23d4e84d6f969e08355a8bef0","sha1":"d5b4cd7042cbb47c8887b1a2697ac6e57b0d2974","sha256":"4354193c021befb6aa6ac15637ffeeade3ba6f67ae42fb60205bdc1fb77ba66b","sha512":"b92df7f1d5cd2468c1d0f749fc946e54d963fcde2552f1458cef1d27d8a22c2df026c3f6cf07e39caa6207b180b44f4bf88afdeb40046c9466f36cb9b7106701","ssdeep":"24:supT3LKcbuR7twy4Ot43zUk0QbFymQdGxBxesx+L5/nvIYfCp5XpZik+iqnzF/S7:OtR92gcyB0zxk5vvn6XENBGL1yZYsJsr","tlshash":"2991d98afa313849c93183b6e416cd305317bdcb466321033df5ffb3369a627694a2a0","first_seen":"2026-03-18T10:59:57.259116Z","last_seen":"2026-08-12T09:31:01.030666Z","times_seen":29,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/PrivateMessage-BiiDLqFa.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.722Z","timestamp":1786150951722,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/PrivateMessage-BiiDLqFa.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-c55\"\r\npriority: u=1,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BMaB%2BTG5XO6eJYJFenDM53x%2F9ipiAGpD3e%2BXDdBbuoGgjFgaiP3BzjBXDhTHWeTm1%2BIPzwW42KgIXb2oFy22%2B682U1nsyIBb1QYppHA%2FAVcK8ERN%2B5wxGPLyUOLJX4c%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a9898592e0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3157,"size_decoded":2060,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3156)","md5":"a5aa867b79a29d921935efd1a2a9fd74","sha1":"42bcce01f95016bc4e5301f7e8825641567435c4","sha256":"9f282902d2966456b781b9094b56a9844329d8dfbf58679f7f92c4f1ddc1406d","sha512":"bdfc8e7a5613b1dfe51a8045b25182807155c257b7163d19930dcbb4fb8f6182ee51ca05b132f2e7fd7155ed1d697f6ce35845091d4f894e9c8b43e088d1c09a","ssdeep":"","tlshash":"e75196ab781c8d3ab33b09a0909100507b1e4fed7125ade1bc0d5b1606f6eb0e9cf71a","first_seen":"2026-07-26T12:43:48.975246Z","last_seen":"2026-08-08T01:31:50.958613Z","times_seen":6,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/png/logo-Bp0GHPXw.png","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:32.013Z","timestamp":1786150952013,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/png/logo-Bp0GHPXw.png HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:32 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\npriority: u=5,i\r\nlast-modified: Thu, 25 Jun 2026 07:52:43 GMT\r\netag: \"6a3cde4b-df45\"\r\naccept-ranges: bytes\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kp3osJBWjSpsvUqOjrstgv43VUApnceWn9YqXxVHr8%2FZoL%2BexyAOYStCFQKG8fm7v4%2BmpylZav3BQE1Q3CXzgVSk%2B7%2BCd4R0rYagGRbhiwE6x0%2FRVLChkfN8UerQCAA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27a989a195f0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 57157\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":57157,"size_decoded":57857,"mime_type":"image/png","magic":"PNG image data, 1563 x 1563, 8-bit/color RGBA, non-interlaced","md5":"4a4ae2940e03b9eaf3997c9b4c7f2a72","sha1":"6c63015a80b5ab604205c0d1521864b6152b5ec0","sha256":"cd3cdced22124df38da941a261c9b010557e76450e103e4412dea087481ea080","sha512":"5274b104bf6ab56727d95ad21e89a345994b7e3cc216e427d7118984a5f42e96a0cdfe24b005f5c3059f7c6cbef1e17d96e4c809bb4d9130bc4d1a2a9b014b28","ssdeep":"1536:1b7xrRgDnO+ThXOP9fOKTrmzPPSpoJDmV3Luwj08N6z:R78O+NOP9fOTzXSwDebuwyz","tlshash":"5243f19ee72afdd1c124da3f02352ac1e211457d799061cac3e3cf6d1976be629c90ca","first_seen":"2026-03-18T10:59:57.282974Z","last_seen":"2026-08-12T09:31:01.021436Z","times_seen":28,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/css/indexAmazon-DG1jyQwJ.css","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:33.676Z","timestamp":1786150953676,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/css/indexAmazon-DG1jyQwJ.css HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:33 GMT\r\ncontent-type: text/css\r\netag: W/\"6a3cde4c-db\"\r\npriority: u=2,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fCkj42oEnwFCzKqvJBRT8PF%2BmrQKq68Bys%2BsuWviQn982H9uiaV3reIIkhSB0izMIIES8rv2srqvxqwmn1n6eQl4Cp6vD%2FSuB1Dy0xTc7dXvhIWwShFU1suy2LD%2BYVM%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a98a47a690883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":219,"size_decoded":836,"mime_type":"text/css","magic":"ASCII text","md5":"fd434a48d8f7385c2f890c559a3e0e7a","sha1":"352d2af62d04337c807e4ecba9f4b8f4cb3390a4","sha256":"b0528ac2d508a4ddea0f5640081dd3fcfde3004d25c296960ef6e2f16e6f8280","sha512":"cec27a72636aea0741053c1a6fa30c439cb621a0ac251530fcd27999b27e237d5f1f0d84d721966eb5c27f594aac3ea747cb3551b8980e866a9743dd9c64fc23","ssdeep":"","tlshash":"f3d0a93126686828da6fe73921912ee151288b12c8230c399be134280bdbe826520ec8","first_seen":"2026-03-18T10:59:57.255032Z","last_seen":"2026-08-12T09:31:01.028533Z","times_seen":27,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-BaGc4iDU.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:33.686Z","timestamp":1786150953686,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/index-BaGc4iDU.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:33 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-209d\"\r\npriority: u=1,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RR4M39I185Hqqvh3oxkQakmFmHHRmuviMUPtthjYv9nDAQZDvuI0rDzEjjUYumN4FypSNKY7FznIXE7buZU5nVc9%2FqtsVB%2FWqzSdgkbyNXeo2rJSoys%2ByFTi%2BXi%2FcCk%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a98a48a6d0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8349,"size_decoded":4326,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (8348)","md5":"855128e24c45b7711eb0e923b4366e89","sha1":"2ca7da41635a451abd8b94e6c37345dcab14015f","sha256":"d47c902f23643185bb56855643fe09cef54050d6f7d420d1120d8bd01f5fba20","sha512":"8a77db4a50762f69a9b2e0c1ffa2e9e9012a6ef95d4d0afdfe44d2cdada513cf553b55fac542c6a04318ec6d6a6ec420183132b6b3c528de4a0a34f6d83be22d","ssdeep":"192:3jNUPlklkoA8n8I3VAo5mWKbm40SASbcAGk5LJ/qupg2Af:3jzl9A8nF3Go5mWy0SASbczk5V/qumT","tlshash":"0002d6c9b0a6aa724bbb1895f0e74151a95d5b48b01794d1f02f9c003befec0a679f2d","first_seen":"2026-07-26T12:43:48.946117Z","last_seen":"2026-08-08T01:31:50.949814Z","times_seen":6,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/api/languages/list","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:32.075Z","timestamp":1786150952075,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /api/languages/list HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nisToken: true\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:32 GMT\r\ncontent-type: application/json\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IyUGH7OQUAlunT2xyxwwKSsLMf4ItgbMf5q7m7CAmIasHwMLOdQhXcFyK1bRzzU%2FPGIyvz0MTCV4BBylIGpPpk3JdSKunu57yo7gcybLoU9XPATi288UKLPuD3FJxDc%3D\"}]}\r\npriority: u=3,i=?0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncf-ray: a27a989a79690883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":412,"size_decoded":1076,"mime_type":"application/json","magic":"JSON text data","md5":"32a561d511428fa2d4ec591069c0dbf3","sha1":"7d5e20932c2d270d2cdee6429f70067ab2661672","sha256":"c51c69fa5c3cd87a381ce9aae2521fe95dbeb1ec2113351c0314217c69621bd9","sha512":"11a1211ad5a09da83e33186138eb1a954de92d5515778f6b90ff2da2fdc8ea2122cd0131e8c9d0d20f35892be1476e7345018472d483bcfd70adf440da1bede1","ssdeep":"","tlshash":"d9e02b195274c91ebc6241c720cabe00908d37174b008e422bcd4f2c8ac0baf141e4d5","first_seen":"2026-07-26T12:43:48.963013Z","last_seen":"2026-08-08T01:31:50.892Z","times_seen":6,"resource_available":false,"data":null}},"time_used":195,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/css/index-B_ccG5dX.css","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:33.689Z","timestamp":1786150953689,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/css/index-B_ccG5dX.css HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:33 GMT\r\ncontent-type: text/css\r\netag: W/\"6a3cde4c-121b\"\r\npriority: u=2,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qMQ4BbVNA5kC5LbYCerzaChW9zVQFLDv91ztOVyHVC6UtToxROetBBr6NdoNcHqc60OsDtHw85tUN4MBAkDmxR%2Bou4EEeq8g8ENX6QOw6PE%2F%2BCeujlRnl5NVocXCnIQ%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a98a48a700883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4635,"size_decoded":1822,"mime_type":"text/css","magic":"ASCII text, with very long lines (4634)","md5":"a07184b9c55bef2f16197ffbe4d6db22","sha1":"5aa972b63b6fb905486ce3dc9285a6022e59fc1e","sha256":"555a6088c3ad156f2977c4ef82eb6aa21873e962a9c908cfc219204d9e54873a","sha512":"725af09c5279ccd22b587abe4dad47a060575ca32d04430e1b4f2a2f79eb4b64999937ce430f94e4565fb8fe85f9b24c889f29a62406ece990e6a011e3c30783","ssdeep":"48:3Yr3BB353bk7cfPG8dZypweClYVeLe52CB2lQlf6JMkJMbD3p/M4rU7Imf2:orjp2APGEyaePoe5r0JMkJMXp/MRI","tlshash":"b2a16bcb9ae06a35df029cfd4b49d1e4f3a4d731ce0393a1f35058964bc7ab21642236","first_seen":"2025-10-11T12:16:49.313814Z","last_seen":"2026-08-12T09:31:01.035089Z","times_seen":34,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/css/index-jeO2aIfm.css","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:33.693Z","timestamp":1786150953693,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/css/index-jeO2aIfm.css HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:33 GMT\r\ncontent-type: text/css\r\netag: W/\"6a3cde4c-97a\"\r\npriority: u=2,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=l0JvU2RQM6JjbvzL2DV69OtdrczmVf91hLnDep7r2SeJqkypBc30o%2BjSeAVSkzR0IWFT1CMS73fbS98J40ow3yWHoZc0aYa2odURnhy2jWyGgMijv2eshW3QGis3Gg8%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a98a49a730883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2426,"size_decoded":1412,"mime_type":"text/css","magic":"ASCII text, with very long lines (2425)","md5":"da3d215b524a5b6465c19ad4aa4b57ab","sha1":"37efde079f2cb35f2906c94291bcf91e66f076a6","sha256":"2fab718e7f9eba2481a7cf7150d5fa81df4dada3f91a1ec4cee69de1adf9b547","sha512":"9dd4161d35bdc3bb2026dd17b871b273d02f6b69ad756c6a13219af52a161ec55dc5c97487b13f3a5f2b3a68b65ed64d89a6d32f65959f6645c8bc7df451efa6","ssdeep":"","tlshash":"4e41dc1bbd8d8434bcdfb4d0b79241da323c73228a02cae3a614643d4ae39f2667161d","first_seen":"2026-03-18T10:59:57.267119Z","last_seen":"2026-08-12T09:31:01.029872Z","times_seen":27,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/api/languages/list","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:33.790Z","timestamp":1786150953790,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /api/languages/list HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nisToken: true\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:33 GMT\r\ncontent-type: application/json\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0jeQMmFf%2FWbhIy%2BV9d2aPYNurQ1EoESJZQnWR7x1O%2B4khw12MMx1LgYF76LzIxnHqjdgwC18RTHVRyxpgGF2ybyqxr00TtKTMhds27CW6fcl%2FVKTPTg3h4UM4PEpECA%3D\"}]}\r\npriority: u=3,i=?0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncf-ray: a27a98a52a860883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":412,"size_decoded":1082,"mime_type":"application/json","magic":"JSON text data","md5":"32a561d511428fa2d4ec591069c0dbf3","sha1":"7d5e20932c2d270d2cdee6429f70067ab2661672","sha256":"c51c69fa5c3cd87a381ce9aae2521fe95dbeb1ec2113351c0314217c69621bd9","sha512":"11a1211ad5a09da83e33186138eb1a954de92d5515778f6b90ff2da2fdc8ea2122cd0131e8c9d0d20f35892be1476e7345018472d483bcfd70adf440da1bede1","ssdeep":"","tlshash":"d9e02b195274c91ebc6241c720cabe00908d37174b008e422bcd4f2c8ac0baf141e4d5","first_seen":"2026-07-26T12:43:48.963013Z","last_seen":"2026-08-08T01:31:50.892Z","times_seen":6,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":204,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/polyfills-C99L_pqp.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:30.928Z","timestamp":1786150950928,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/polyfills-C99L_pqp.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:30 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-1a01d\"\r\npriority: u=3,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=epFDzCYaQsDjMsT1dtwwSKt6iFf%2BEmwCB14lF%2BgrlZKADkVs2lwW%2BXB%2Be3d1XBLjlcwYo5stoK1%2F6y%2FNIAcOIKxzEmW5prmAXoz%2BhJevP36lksBp63P0TbER7c49mdA%3D\"}]}\r\nage: 264\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a989348ce0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":106525,"size_decoded":45184,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (60494), with NEL line terminators","md5":"119786325b9084b364895b7d7884347f","sha1":"565b982f4bc612bebf0bb137f012cf1b9d624c35","sha256":"99823f983075ce0322f39a4cb58544bc69502ac7d8f3faa845f3b7ceb543e773","sha512":"679c8d9d7c8448b757872fd31c169b951eb5fd070bd0c25ca8e5c2283c5dd32c719e5cd4cc7b17d3d19d3e3b26887045db07bc56e1749dad62458656d30d7da0","ssdeep":"1536:mKKTqvzfT0PYi8i+IrnWvQmfDymutTHk1y9qaA:mKYqvsPTrnWImfDypTHk1y9rA","tlshash":"53a3e6c9f6c6f0a243e760a4403f510bf23b6d55b80e8194e762d1d17cb9a8ac17bf69","first_seen":"2026-07-26T12:43:49.108869Z","last_seen":"2026-08-08T01:31:50.95247Z","times_seen":6,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/css/index-VWzXUOe7.css","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.785Z","timestamp":1786150951785,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/css/index-VWzXUOe7.css HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: text/css\r\netag: W/\"6a3cde4c-7d\"\r\npriority: u=2,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2Y8JV%2FFSwbEqq2nHCCF0p24e53vo8ZfdHBRmGjYyIutAsmVjhzvktzwSa7xicD9D6XXEGuDoW6R4XLis1SG1LkltJlhJlUindrfmc2ZZ96g14m38QP1WtRtRJJoHt8s%3D\"}]}\r\nage: 262\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a9898a9360883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":125,"size_decoded":764,"mime_type":"text/css","magic":"ASCII text","md5":"6c4d51047d9ea4df74c16b0921be462d","sha1":"5c3b3ac5006e72a21a1f8b9c1cdc9aabb1b35447","sha256":"2ffb4b0fe51bd783452b3891a21eb5a75151053447bce81a71dc243d0ccc74ae","sha512":"74537bc47a9bddd2c9d003d37e4de4621fb32637663aaab41006b95b1dd5fb28c63674329124fa4d5eb6887016657c92f1f6d1f467f5cf51c62075702d2f8d34","ssdeep":"","tlshash":"17b0923f04a01b0829438c800f8c03274630c82215132bfcc8b46c2aafcfe804f821ef","first_seen":"2024-02-20T23:53:55Z","last_seen":"2026-08-12T09:31:01.036033Z","times_seen":57,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-Dp5wmByz.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:33.685Z","timestamp":1786150953685,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/index-Dp5wmByz.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:33 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-d40\"\r\npriority: u=1,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rUr7kWYfiDYMksdwfssTfxOVxgupJXR8V77h51zLvks9U8w47F47z%2Bctp9qhzvZmy1VxmYECTGWnimicOUIk1XqkFLkU5gBW%2BqxANc03%2B5Zqg25m498rfOWo5qrZCT4%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a98a48a6c0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3392,"size_decoded":2256,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (3391)","md5":"a687bbd4b398852597765056844278c4","sha1":"5f11009ca5343521d0fce43fce6b3aa5d840f126","sha256":"647252bae3b64e16cd39c478e75982bbd78c79087413c4e3204ddcb8c622c6a7","sha512":"2a4b0a97727653fd9d011aaa478ac870a16dc5adb7bebd7cb7ba0c7ca2045a086f541bda60c73f3749d92c968c1aca743e2a0df0b739ae4e605cd1b3bb1e0ea3","ssdeep":"","tlshash":"b261b42cf6558ef4a67345d868170020710e993f4134cb45e2be4f983a92ed2d66e33f","first_seen":"2026-07-26T12:43:49.054535Z","last_seen":"2026-08-08T01:31:50.957269Z","times_seen":6,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/jsencrypt-B3YSpQTJ.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:33.690Z","timestamp":1786150953690,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/jsencrypt-B3YSpQTJ.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:33 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-e2a8\"\r\npriority: u=1,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ditOcxIzm3SuUi6D1zw5rxLCb8c7GMyleuoCZjiNcrgVHXukjz3itDswDB0TihSOZlfhXfIJlbDMu3gevOwXpsoblmnAYRdyNvzxZyoPG0Yo7FE0pIGe%2F5jtgTFwxxw%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a98a48a710883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58024,"size_decoded":20345,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (58017)","md5":"964e4e4a69bb9657334858fd83c05313","sha1":"df7a1b45fd2aea42ae580c9448ba0f651fbee04f","sha256":"e105c23feadd44d9aebb41c0f8ea06896d95296454eead53cd6b07f25a294631","sha512":"ec9614fcb6879e6c6ddabadf6bef440be5fcce76d4eb1fb489c9c0ebbba30a28f6c1574e47c7e53945d77e52d0a44c3382a0d6e69102f947cdddf7d4bba1ea39","ssdeep":"1536:+6w122LcoS6YxwVTotuPpYiGRPhOgPzU13oyNool:Vw122NwxwxotuPpYiGRP8gPzY3oyNool","tlshash":"9b43d8c972e674a503d6e0b0062f0546e23fb61d591e90bcfa59c8f2acb4d49513bf78","first_seen":"2026-07-26T12:43:49.007082Z","last_seen":"2026-08-08T01:31:50.984796Z","times_seen":6,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-D1or5p_0.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:33.691Z","timestamp":1786150953691,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/index-D1or5p_0.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:33 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-717\"\r\npriority: u=1,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3GZh2duUgzHJcf1oihfEnuD3b7OPWvLtr4cxuuBmiYWHS3MSsicId21cmHI%2BdjYb7jD7ZiUTsQKYVZ34Y8JXw0TC%2FVxMP2JSK%2BOwD%2BuNjEWFLWejgBZH1P0qYg3nYDo%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a98a48a720883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1815,"size_decoded":1670,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1814)","md5":"d58d8a7fc34c93ead93d15dbd4ca772c","sha1":"d70fd4523578aa32613d0e2ef8c4099d869de4e0","sha256":"f41967ad5cb0ce22bac7af5a7aa90c259eca5f0658ae36ed903ac87c652f8776","sha512":"0bbe130a6b9ccdba7f252ab46b9666756bf4ab1ff55c26cd4da70da7713858f1c4da5afd3a8ec2832742aa66efd32b9ba6939e6ef860735071828029b3d9cc60","ssdeep":"","tlshash":"ee31738b2ec817720c0798fde11aa052a57d1a1c3c5051e0c059bd1a616ffc4eaabd1c","first_seen":"2026-07-26T12:43:49.041378Z","last_seen":"2026-08-08T01:31:50.985659Z","times_seen":6,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/api/message/private/list?readStatus=N","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:32.079Z","timestamp":1786150952079,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /api/message/private/list?readStatus=N HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nisToken: true\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:32 GMT\r\ncontent-type: application/json;charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EmXA9zxiIFWCnuspKuMW2H92bcJIWDYXQg09EGPQ8vJ%2F8%2F1pBzcnt1axlQzYANbtDjTV52cNK79E48Nwzt03KP2muwcc9taXI6EE9ZnuxGKNaS1GrufdB9q%2FPnASRSI%3D\"}]}\r\npriority: u=3,i=?0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncf-ray: a27a989a796b0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":99,"size_decoded":936,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ad962d7d87eb184b32eaf43fb8f79aff","sha1":"170e94e21e16d1607f54e778d90a768583e29a21","sha256":"b5f7f45e6696631ac8b9060fd0eb658220f7d321ab2a1ab543f91974142acd35","sha512":"daf0892294116f4983cc53b5ebb37dcb41c0220ff92d942c0a16688bd90f1363fa42120f96ba00447779b269560e50f7f5470c1cf8f07bf1dd6fbe4fa8dd49df","ssdeep":"","tlshash":"1bb012702b5d4ec7201241b79b4413052437d44c9a545b501b0822f6041884c24ac6d8","first_seen":"2025-09-20T14:52:51.10955Z","last_seen":"2026-08-12T09:31:00.994695Z","times_seen":41,"resource_available":false,"data":null}},"time_used":381,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":381,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-08T01:02:27.233Z","timestamp":1786150947233,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sat, 08 Aug 2026 01:02:30 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TUXSS2YQdX0vrwNI9IQhPSThcVDt%2BX4SHqyrk7ZLH3GYzz0MmNTUzvoqbE4uluAb57Fh8h2%2BZS7ZCvEDUvwsI1ypCg0MED%2F5uP52LCjRtTWnMyHEtyznw78YbmBBDJY%3D\"}]}\r\ncache-control: private, no-store, no-cache, must-revalidate, proxy-revalidate\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a27a988fac41b4fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4363,"size_decoded":2126,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (4363), with no line terminators","md5":"b1459465dee7759edfab21be99d0498e","sha1":"3f43712896874883ebd32c1602dd654671bc1120","sha256":"ceeda9a581da31a93a7f335834aa014e28268a53d5144e9522cade26465ef4e2","sha512":"1ce58a075ed99a8384b7fc1df5d7830700da46d376a4ff300cf23891e42f7d80d861e9db5be1f32a7d339416ba74f4f46efb11c4c492dd8c525f266ea7b2602a","ssdeep":"96:BJHZLzZhCZydHRH/pW7AnqBAngzVkK7uB1piHliH3H/4:BfGZCxfueK7uB1piFiXf4","tlshash":"f8913256edb8d9b3c723d92775a8504084a04cb3eb171040b2e724e8de91f6a5b1c8eb","first_seen":"2026-07-26T12:43:48.949624Z","last_seen":"2026-08-08T01:31:50.897884Z","times_seen":6,"resource_available":true,"data":null}},"time_used":3485,"timings":{"blocked":-1,"dns":4,"connect":1,"send":0,"wait":374,"receive":0,"ssl":3106},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-CfgYFPgw.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.766Z","timestamp":1786150951766,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/index-CfgYFPgw.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-703\"\r\npriority: u=1,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I%2Fy0FfnAhBZaJKt87zTc%2Fr%2BuSq3j7qo1wKbgoBCKWge%2BxktdZ1UTh3pkpvriy3zy1yDMQDKLHHwP7%2BAW2EMRoMAiZIrMvpwRuc5n08DfswR3VzqwwQI5HGae3l4VHkg%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a989889310883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1795,"size_decoded":1630,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1794)","md5":"145294516c9070938e877ca2d99a79cb","sha1":"8da6f85ddfac4faa3ddb795f340cf50ff23927b6","sha256":"f56084bf1b4feaaebc7edcc747ccd0d752b604484e6c1ad78d4d291799b391ef","sha512":"f866b615152600c68408bc4d77bded1697084cc3efa590a34c4c07d6b56718c97232cbe1b3ca41fea887675005316cf2666dc423fb71ac86a8f786a2615333d7","ssdeep":"","tlshash":"2e3196a6f8f4de79a5bb1ac0722b0025996f07a8a56140f2f6ef07041b7c8d4d89fd5c","first_seen":"2026-07-26T12:43:49.092852Z","last_seen":"2026-08-08T01:31:50.930425Z","times_seen":6,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/css/index-C-ccZWgs.css","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.781Z","timestamp":1786150951781,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/css/index-C-ccZWgs.css HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: text/css\r\netag: W/\"6a3cde4c-a40\"\r\npriority: u=2,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z2dwPjSOZheAFOqE3k7eDTAbNORlJ1jiPVA8AQlfP3vgR9Y8R3QDGwkgzFfBqt1vSDKasonpR4i%2BKO788nlLHrXbXvfW91icb1jwpUB4rCSEv%2Fwz6qltp6iUiBhg9QE%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a9898a9350883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2624,"size_decoded":1374,"mime_type":"text/css","magic":"ASCII text, with very long lines (2623)","md5":"713c8be43c792823c9d6a983fea5c2dc","sha1":"9c2fb3d06e76a164fdea2e463ac301bc785b5bd5","sha256":"83d4859830dd7e284851c1391763b52888b1dad1f67cacd697eb746692afe2f9","sha512":"afe4c7bded4ad04c8df2084cb02a2e233b3aae3208bcdc127fe3579e4b83a6486c881f3c11696d6d772027610cc73699e873aa1941785ee5806a331ef0b56b1d","ssdeep":"","tlshash":"4351096bd95146faae23a9940f5595c9b13cd8208e00dfb2b1c0d51c8fcf6f616136dd","first_seen":"2025-10-11T12:16:49.321923Z","last_seen":"2026-08-12T09:31:01.008121Z","times_seen":35,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/general-D6Z7Ijj1.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.787Z","timestamp":1786150951787,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/general-D6Z7Ijj1.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-f9\"\r\npriority: u=1,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=E6XVOrS5yqdTxRCasM1Oeznl%2FySJwF6u%2BH6RbV%2F5PHkTqr4LixGzBMlWRs9koDNrfrW9g%2Fg1IoiFuvQlx7FJtT0vFsq6tM1QB9SmDDbWv6Q8xysF5RnUYsoIhVO5zVU%3D\"}]}\r\nage: 262\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a9898a9370883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":249,"size_decoded":850,"mime_type":"application/javascript","magic":"Java source, ASCII text","md5":"5894303eb9adfea6b272462f07d5bcb0","sha1":"495b6023535aec7731f8aff81003170aaf73ff9e","sha256":"488b5cf4242e7a27b0d644449010cfc87299f9dee7218c8e2230772aa623557b","sha512":"9bdbc2231c55284a349981cda60ee06b180e91588f3fb85e8f3d9a6422e011668745657087f8db34c40c0c74653785f1729657e89625183371a5e3c3ba8a9919","ssdeep":"","tlshash":"d9d02e6b2aa2ecf0a248c00490ae680693bac4c8a12e00417c1200cf2af06b8967f44c","first_seen":"2026-07-26T12:43:49.168139Z","last_seen":"2026-08-08T01:31:50.938859Z","times_seen":6,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/css/PrivateMessage-DBKizNeC.css","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.791Z","timestamp":1786150951791,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/css/PrivateMessage-DBKizNeC.css HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: text/css\r\netag: W/\"6a3cde4c-234\"\r\npriority: u=2,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xaU3YfDu3f5Jh52u8YP4vNZnVBsOqOUz8KNuyAVggcIA0cgkScMDBMaLG2wTkwYrdjESJLRBxPlEVvkalA8LshC6ZOEw2UcuWqmvFVz1%2BhTq%2BwSceiEYlNiK1Z3O%2FTA%3D\"}]}\r\nage: 262\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a9898b9380883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":564,"size_decoded":915,"mime_type":"text/css","magic":"ASCII text, with very long lines (563)","md5":"83d08b6cb2b91bce7c0ad7124fabd553","sha1":"f298db95f52d6f7a8874de96272a6621da9b0f15","sha256":"d10084fdac5804daa3668d63c5ccca8cba52a0251c94b4e37e4a2b910d501f87","sha512":"6be76d681983301037d31a24522cc1f7fc9df5b47444fd2113af417cea6517ed2e8dbf26c02cc8a55cc5e56c8feb683f38202a1946780ad857c02c7260bc15cf","ssdeep":"","tlshash":"4bf0fc37221a2614d577fca0af741553d2a0d433f10955e946419a2dcbcbb9321ea35c","first_seen":"2026-07-07T11:41:25.849815Z","last_seen":"2026-08-08T01:31:50.966807Z","times_seen":7,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/Goods-gAwAIAw3.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.794Z","timestamp":1786150951794,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/Goods-gAwAIAw3.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-36d\"\r\npriority: u=1,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ohnx5uoJXyds5bAv6FsEBCwn2CtkErejMTKRUHN%2BTx%2B5reFSERtdDDvLaNv%2FZGRZ6CFXEsorShm7GWiY4cE6dZcLdDCM1K0PyoP26AjE0L2TWjY9zrIg0xVNcmDNXwc%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a9898c93b0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":877,"size_decoded":1080,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (876)","md5":"e4275e9cb2d2e3586d9e4ebf792715ff","sha1":"9495e40bbea2770b100e5ee0d387cd0e18b8bac4","sha256":"e557f83ba84008dec7dfd948c0ab444cbcd0ab5f47656709f3d1f681705b4e1e","sha512":"f3040638d1446267a01ba0b9a0e9647b44f8100a78af72dd8d423d7a11f723090bef2c45cf2d01e1dd4c5134155de83775fbdd731c4e7b6c8691c04f78b78c27","ssdeep":"","tlshash":"b011808d6781fc657559415364ae542b52fd4e8bc63c5824fc8b4fcd289843d933d41c","first_seen":"2026-07-26T12:43:49.044398Z","last_seen":"2026-08-08T01:31:50.95583Z","times_seen":6,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/css/index-uWRL8fIo.css","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.806Z","timestamp":1786150951806,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/css/index-uWRL8fIo.css HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: text/css\r\netag: W/\"6a3cde4c-608\"\r\npriority: u=2,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ciz8Dqqj075qSGzp2Ui8QNeHY3jiajzz5a88DdrqcCAjb3PlLClbSUq6xh5s878n7ktOE18DZ9Cn1OO0znHdppb3Pe2DY%2FW5t0pa0xTdZNPx6fGasIeSHsOnIOdG%2Fks%3D\"}]}\r\nage: 262\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a9898e93e0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1544,"size_decoded":1170,"mime_type":"text/css","magic":"ASCII text, with very long lines (1543)","md5":"501d2c32d64eeabb49ff646a696c316a","sha1":"cac9370e1b002f49cac8a5aa6662bd6d57ea484f","sha256":"4998805a08a83ea1984bb24d6db4dae41c84a35edec6308e35ac622ca2c53efc","sha512":"502f8815e9028bee5b5784ee6021b9efb3f574b595b55b381c9333be0bd2fd77633181434758fe754c9ca2da3dd9b5b5d832621be0290967868325f060351fe6","ssdeep":"","tlshash":"c1314860376b2478b46aeb2c2499c16d5b74e537c241c49d7e54c91acbcb247a2f1b0e","first_seen":"2026-07-26T12:43:49.029506Z","last_seen":"2026-08-08T01:31:50.946208Z","times_seen":6,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/api/logout","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:32.467Z","timestamp":1786150952467,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"POST /api/logout HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://am.nrwhl.lol\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:32 GMT\r\ncontent-type: application/json;charset=utf-8\r\nserver-timing: cfExtPri\r\npriority: u=3,i=?0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://am.nrwhl.lol\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qxGTrrC4cr180mMfYeFOTtRN3Y72PkSLR90gFKZDdQzbl7eTbvPm0MohD7KeIMqESsErHTOXTxdXemkftaICkDhu98iVWdAYIGI46zXZkcQS3cIHL5MPWYShVPs0nbo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27a989ce9960883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 33\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33,"size_decoded":942,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"a71c90ab95c7aea35a5366a04724c3cf","sha1":"89ad22e24f083263e8907bebf81ab193182ba230","sha256":"5406df7bd9f22a333cdac175da070e5bc4cbd11975c8ffa857de88b008fb4231","sha512":"65db18c3518d07d52097ea01f511dda84ffe8a39ab422ff7310b6b770380d47d9545ea8ad7800dc026404555b72cd9453c3d569aea0a623b0e32798d3fb1d391","ssdeep":"","tlshash":"258000aa088ce3a3bca320b8220a220000a830802b30c30c8c2ec23800c82cb88008c8","first_seen":"2023-05-13T02:04:34Z","last_seen":"2026-08-12T09:31:01.022177Z","times_seen":51,"resource_available":false,"data":null}},"time_used":195,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/woff2/iconfont-CKcwYJzN.woff2?t=1773836846298","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:32.073Z","timestamp":1786150952073,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/woff2/iconfont-CKcwYJzN.woff2?t=1773836846298 HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/static/css/index-B7dQukp5.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:32 GMT\r\ncontent-type: font/woff2\r\nserver-timing: cfExtPri\r\npriority: u=3,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:43 GMT\r\netag: \"6a3cde4b-1c414\"\r\naccept-ranges: bytes\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OOOIC2M6WbHnseEBCsf4RXwh86joeIRht8vxYz2HWTk5ssgdze9uPsF%2Fy%2B4dVWix6DsdKpz6eE1xmFVWrGRznKFtknU7rjysLdACvQ70GvcpNfqvT15xxzEmfMv5QkI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27a989a79680883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 115732\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":115732,"size_decoded":116430,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 115732, version 1.0","md5":"abf9b78e13d342e48a27d6523ea7392c","sha1":"457970a03a4beb139db6d1df05581f1abf4b15ae","sha256":"489030dc941e517677423492681ca4a20997123d450e83f2f2e5c484ee1c894c","sha512":"f02dd566ee60e2bc022904067ef391b07d391268f174006516ec5b4c4af9a9b3587a129df6f0f023667ce64bea9d4afe02fde0de2ac0a9c6cdf1f4c55b9d3d21","ssdeep":"3072:1bGA47UrzOmTQP8yAgdYH9QYfvaR4g/rDq7Kkcax8t75:0f7U3VyAgdYH9Zfvaa8rDq7j9mh5","tlshash":"61b31211032586af008b63ed3f5f64b4efe9911028de476bf01f0bba992bf9b55486c5","first_seen":"2026-07-07T11:41:25.863431Z","last_seen":"2026-08-08T01:31:50.91519Z","times_seen":7,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-DfUW_fvn.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:30.929Z","timestamp":1786150950929,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/index-DfUW_fvn.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:30 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-17469e\"\r\npriority: u=3,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5Dhwy6xsbMvvCWWeivtbeJSoTlsicTWepZ0truHSYKzlhHOHJqD1uOTFYaoJwYLjWm7Um2Uu5NiHhhmcXBRmZtEg6SyBWFuhr6QMWwmG3tdmVVGkNEZ60z3ZLQMVJL8%3D\"}]}\r\nage: 264\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a989348d00883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1525406,"size_decoded":469543,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (34758)","md5":"b8f7ac4fa8edfe98753855e5b6a9d69d","sha1":"7cdfd9ba7a80147183e1412581422b1db1a4d6e9","sha256":"66ebadc943909a749878557126b52323221c854ac25d6829a9ab241b74288e7f","sha512":"f1347f4654aaeb9afdeb9c4ec8efdf99b23e4b7e663c7639ac569f09e726da25d2a72650ed4d93e49889b3293b685b3e425bc361d2f5cbd295d694fa26be4be8","ssdeep":"24576:4qIB39amBxInJ9yeV+lT0qNBaqezczJTNREWh1VV3k/4O3+olHhgt:4qIB399BxInJ9yeV+lT0qNBaqezczJTj","tlshash":"d1257ce5b71422bc098a43dd763ab020732d58ea76c5ccb4e53ccee52b93459c947f8a","first_seen":"2026-07-26T12:43:49.010765Z","last_seen":"2026-08-08T01:31:50.936045Z","times_seen":6,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-CAKy-Pee.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.714Z","timestamp":1786150951714,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/index-CAKy-Pee.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-749\"\r\npriority: u=1,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p5GVe2B%2Bn8GF8J6%2BX%2Bf3BLm9Mu%2FB3uIfHqCfGpR6MhCrcQjHPFeOn01Z69wPSfULScpiX7fWM%2FB8Zrqwf7qZ%2BCHhBj39d%2FlV7eDJn4C5z09yKtbDSRDKf31lxggzRIM%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a9898392a0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1865,"size_decoded":1699,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1864)","md5":"262056b0412710c089d3b7427f3a7597","sha1":"1c3a8d988f4f70181f2d63ce89e0f82093544a85","sha256":"412560e19a132638b05d274e311a1e863d1de6c02f14ef691fcbb6fa25d24a94","sha512":"7587d0d94d52962a1bf9308b9cbaff95cfc22cb559e9ea59d26257b7518f89d633ca29d88ede848afc5e43265f003fc014b2f5d80a02f196085a19bdc85e6080","ssdeep":"","tlshash":"12315751fcd8b57013939dc8c16e48919b48165bae6cd6e1f07b7c902b7058de578f1c","first_seen":"2026-07-26T12:43:49.07874Z","last_seen":"2026-08-08T01:31:50.940745Z","times_seen":6,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/js/index-OWBrqJHp.js","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.772Z","timestamp":1786150951772,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/js/index-OWBrqJHp.js HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: application/javascript\r\netag: W/\"6a3cde4c-7b8\"\r\npriority: u=1,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Xs53ru5E1j9LbEcNvNDvvGWByBu%2FDZxFCHdnAgV%2FNBa%2BTvZZFklGOYPA6LmTz%2FldRXZh0Li9ZKwZ1FUUFCzVkwZ%2BzIfX3oTMVlm%2BhrbMm3TajrMskdUI7Xvz8j2p1s8%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a989899330883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1976,"size_decoded":1671,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1975)","md5":"5c31850df215f8990a782b3839720139","sha1":"46061f5178f7db3bf9c254dde13cb04bf58f0219","sha256":"0f878a906163c76e28175d82d634a0761763cee6602a06476d0bbc03b55c52f9","sha512":"0415d4e5b36fd06b3a2acd49215a0767913fd4c057fa61d5b8521a6ce4f5d7e24e324383bf5fd760ad8557e6e33c4355a69e149fb57d674b0d84ed7900842edf","ssdeep":"","tlshash":"4141666d79c89078dbbbd88c90320506f91b5b191634adf1e0ee5d6c2e37508e13be35","first_seen":"2026-07-26T12:43:48.93261Z","last_seen":"2026-08-08T01:31:50.954434Z","times_seen":6,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/css/GoodsItem-C64MT-Sw.css","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:31.799Z","timestamp":1786150951799,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/css/GoodsItem-C64MT-Sw.css HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:31 GMT\r\ncontent-type: text/css\r\netag: W/\"6a3cde4c-1fc\"\r\npriority: u=2,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:44 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zpN3CC3XB%2FZXeKUQegieM5exIFQfc1JcIG0pE16r2StvW1MvWGGlhglDLgVGt%2B3%2Fbjc44w%2F9YiLYj%2BEIwiEY3RyewGOE7OryTkaqakPyPjJtuuiKc4SNwJqeE4HpGik%3D\"}]}\r\nage: 261\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a9898d93d0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":508,"size_decoded":950,"mime_type":"text/css","magic":"ASCII text, with very long lines (507)","md5":"df53eda6ce1ec7e19b1538d2e420bda9","sha1":"74596924a9bd5b8d3193b4a4bf97db26815bf4f7","sha256":"096ba7e2505b7894cf7c7f3593df4446c1f36dabd14eec38c129129ea3344887","sha512":"353899f2fd12710f0387b716551d464c94de5ea41ad5031a91e7f6274f2c78adcbb345575070d25c3157fb95a92dd6021177d3bf8aa6342169bbdee66162fe80","ssdeep":"","tlshash":"2ef0e2e52819700b71fbc022b96acd8e72ec1206e31581ae5da03eb2ddbec473c71974","first_seen":"2026-07-07T11:41:25.843507Z","last_seen":"2026-08-08T01:31:50.944802Z","times_seen":7,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/api/general/content/list?type=dialog","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:32.078Z","timestamp":1786150952078,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /api/general/content/list?type=dialog HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nisToken: true\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:32 GMT\r\ncontent-type: application/json\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8cPx%2FFclv72FCkZx75qvdzdjZ10Cs%2BdxIdjTScaLqg0vYNiQfiSAN8dChzA%2F8z9huUAgPbf1c2awtcug07fwqJM8JwycZHczBC%2BDgVl1ckCyfLE5mkxF1JuFzHAvy8w%3D\"}]}\r\npriority: u=3,i=?0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncf-ray: a27a989a796a0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48,"size_decoded":873,"mime_type":"application/json","magic":"JSON text data","md5":"d5d7daafd3c9c355928f05dcfbbfb7f3","sha1":"0ad2105c4f4b4bef0d1fd1bbb433a7681f231d4d","sha256":"3237331a4bf5cdad36089449cb3068fa812c3cc810b45f4d88b343872bd04457","sha512":"5e066badb556bf43a54f89af935080b92f2d61b1dac8448ccfb68f9b6d56526ea330f5a60bf957615210353aca6127c5d27341d037244ae3ad85c9ccd32a57df","ssdeep":"","tlshash":"1d900262080c89961606a0490107450406b410990e1017949d9d426529496918686418","first_seen":"2025-09-20T14:52:51.068892Z","last_seen":"2026-08-12T09:31:00.988638Z","times_seen":39,"resource_available":false,"data":null}},"time_used":401,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":401,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/api/goods/buy/list/30","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:32.081Z","timestamp":1786150952081,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /api/goods/buy/list/30 HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nisToken: true\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:32 GMT\r\ncontent-type: application/json;charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Tf0I3ikUHww3KBAjGC%2B%2BSKwlf4LIoLwTgJ86ix5dUFZ1guVmWng7VZyXmIO7Box3etwWwJhnNqsJv%2FCgWjL9CK%2BI5i071mXcgR%2FNU3EBCrgHLIzk0vTjjCY9PWA6p5c%3D\"}]}\r\npriority: u=3,i=?0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncf-ray: a27a989a796c0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":96,"size_decoded":937,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"1bb166066ad4eaae80c46568d7c4646e","sha1":"332de84b843016d8728b6b4d37fb301b1f1eed61","sha256":"340360bd1f862d98df7a81c5edb0b1e3ec79e39e71b9be168a48a89ca12582c9","sha512":"2ed6b4fe2c7d916254f6420eb63245aec57f6e01726074d3c064a77b7d023fdd97f67c5148646725a272fc820f9fd1453e561efdc077a306897fcf316c7a611c","ssdeep":"","tlshash":"63b012381b5d0ac320a101960f4512151012d0449a010b902a8c22f5445c84c345c599","first_seen":"2026-03-18T10:59:57.281393Z","last_seen":"2026-08-12T09:31:00.99667Z","times_seen":28,"resource_available":false,"data":null}},"time_used":398,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":398,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"am.nrwhl.lol/static/css/index-B7dQukp5.css","fqdn":"am.nrwhl.lol","domain":"nrwhl.lol","tld":"lol"},"ip":{"addr":"104.21.17.252","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://am.nrwhl.lol/","date":"2026-08-08T01:02:30.932Z","timestamp":1786150950932,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nrwhl.lol","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 03 Aug 2026 06:43:45 GMT","end":"Sun, 01 Nov 2026 07:41:16 GMT"},"fingerprint":{"sha1":"06:4F:09:19:7B:05:A8:6A:3D:6B:4F:4B:B1:51:14:24:72:71:04:90","sha256":"1E:FB:C8:20:3C:14:E6:89:0F:E6:C4:A4:2C:36:14:B8:39:16:42:92:DD:AF:08:7D:A1:C6:B1:D3:CB:12:E4:B6"}}},"request":{"raw":"GET /static/css/index-B7dQukp5.css HTTP/1.1\r\nHost: am.nrwhl.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://am.nrwhl.lol/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 01:02:30 GMT\r\ncontent-type: text/css\r\netag: W/\"6a3cde4b-24da2\"\r\npriority: u=2,i=?0\r\nlast-modified: Thu, 25 Jun 2026 07:52:43 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xQFe8HCT6QwHZbbvJ68da4%2Fdz02qDdCUF6YfN37VTvHm1t4MCuUD%2Bn4H9Sl7%2FA%2BjUBFhlpNNSUWnDof7kx2UPnPUPB3hIn21%2BshT%2FZ4At7e3RhPvhotc1ZQvdG9dXBo%3D\"}]}\r\nage: 264\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a27a989358d10883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":150946,"size_decoded":50020,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65018), with no line terminators","md5":"2859ac739c64c8fbb9f2012b178d2035","sha1":"adefbe19642fe8bf841d754a4c709d285a818bec","sha256":"28a4810c29380960c88361b00781280aab1f581c344d3d5910fca27274b4a5e4","sha512":"6ba5e4c55a2093ba756155bddcc5fef006a901d4bf1c3323f180b38cfa37df01b182f340fb740d69929d6c40a199f5408c609f82c643ed890ddb89d5bc207158","ssdeep":"1536:lVIyNBi3MFYaQj7FCwsBlDOFIxuVoxGhT/BGP4+d6TvC:lPNIClDsIxuVSGBZGP4q6TK","tlshash":"c2e34bfa90c801ec2b32d566c786768cbd28f271cde19d96f00b510d0fe77a55392b6a","first_seen":"2026-07-26T12:43:49.164453Z","last_seen":"2026-08-08T01:31:50.92815Z","times_seen":6,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"am.nrwhl.lol","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}