{"report_id":"04540825-e3bd-4529-a886-ac47eac8e88b","version":0,"status":"done","tags":[],"date":"2026-10-08T21:44:27Z","url":{"schema":"http","addr":"wishwork.skin/","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":0,"asn":197574,"as":"ExpressHost Ltd","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"http","addr":"wishwork.skin/","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"title":"Wishworkskins — Vote for CS2 Workshop Skins, Charms \u0026 Stickers","dom":{"size":27159,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (13843)","md5":"b9c32242fc67a343ca191265bd1de548","sha1":"1e7696d774b94bb9775543d460cd953bca593807","sha256":"dc7e76be207c8d99aa4e2436fbc07663c9a65b04a40c4d9c649ba69579b0d2bf","sha512":"dca1de5856d55d1478cc36a06d4652ddde1004af3558b0d22220e29508433a56c8c4ab6f0f8ad0573e6e877b243d01463f5dbd83d460ec68917abd95209c601f","ssdeep":"768:EIU+ZObyaeqece9e6eZe+eEezeteGePejeqeueoeUe2eTe+exeme0eiejeZeFedb:ESObyaeqece9e6eZe+eEezeteGePejeY","tlshash":"72c20ea6c1f659371233c0c661ff5b3531e8890ee6961818a6fd42fa5befc12741790b","dom_hash":"domhash471c0a905ecbd88ad3d6809ee0cfcd9d","first_seen":"2026-10-08T21:44:30.705099Z","last_seen":"2026-10-08T21:44:30.705099Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"wishwork.skin/","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":0,"asn":197574,"as":"ExpressHost Ltd","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-12T21:44:27Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"wishwork.skin","ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"domain_registered":"2026-10-01","domain_rank":0,"first_seen":"2026-10-08T21:34:43.480982Z","last_seen":"2026-10-08T21:34:43.480982Z","alert_count":40,"request_count":40,"received_data":1215601,"sent_data":16785,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-10-04T22:46:21.559025Z","alert_count":0,"request_count":5,"received_data":246725,"sent_data":2855,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-10-04T22:47:16.540786Z","alert_count":0,"request_count":1,"received_data":13319,"sent_data":532,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"wishwork.skin/data/items.js","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":false,"md5":"49463ae7caa26677a63b3c12fb953993","sha1":"522e207665d31accfc19a9f8df0224435130e93e","sha256":"7e4ed0ad708977e1646dbef4a9d0316d336586d17f4bb170f2efd02cfbcbcf78","sha512":"1145461ca6862d9c337ec79175f4376bc622e9bac7ce45e1b02cb77190db1e7435d04fe35cff560a8a5e1c6591c3221daa9c25c681b83036ef8b762efa3dc85b","ssdeep":"1536:JeU2eQgQe4igevMU3SbOUqeqUJHEX832w1edBUFT+Qmlz9nC1rAlUDmFInEHfmGo:rH8xvXvtDoWj2eHfkXJEtvOkTwnI","tlshash":"38b4eb7785102f8b0bb891e97c5ea24ef261972f44429647f73cd14cdff12e360a2a69","size":533810,"data":"","first_seen":"2026-10-08T21:34:47.355557Z","last_seen":"2026-10-08T21:44:30.753156Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/data/overrides.js","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":false,"md5":"ef4cde30004c5d239731470a1980b9d5","sha1":"cdaec712f301009bb3b4932c7011bb9812eefa9a","sha256":"5761adadc0eb7673154f8858423e2c81271947f118c028284a13afbe01a0b510","sha512":"0754165accb3268ff4a79392532067ba6f0e1616f2b7de47f6bd3f0079e3280f71435bfa7a241d86970d8756480d16c3bffeb702ca2017acd120db4e36e932f7","ssdeep":"","tlshash":"3b413520e29030fb0218f093dd0c664dbdf55dff2aba52057d5cba7aa7e5571423911d","size":2170,"data":"","first_seen":"2026-10-08T21:34:47.320887Z","last_seen":"2026-10-08T21:44:30.754244Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/app.js","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":false,"md5":"bebafe0ba1fd4721795f8e62a8b31f4e","sha1":"929f229581062f9d33fcf789ed2024d5b7fcd3d5","sha256":"c4e19890351ec1fa614235df6bbd830a07a1b9ec2a2b76543b5eb4e426c27da1","sha512":"a59b17cc0bfd8c618b55ed091225da0cb3a7dc4d83c20932538a0307ad8c3d53dad49c15ab58dcb3eb1b42cffd8a9aa4ff7c64bfdd1d63194ed4a07548522bfa","ssdeep":"384:1p0eEAcS79yDRZBUplR4FXLeYfY8P2VGNwDzHukAQv2DR8Yqd:1p3x9URDBLeKYtVewDzOkm/qd","tlshash":"24c2752af9ab25364533b039ab4f9118baf6041b2185cd107d8cc8996fb8c7953bdddc","size":25789,"data":"","first_seen":"2026-10-08T21:34:47.337658Z","last_seen":"2026-10-08T21:44:30.755157Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"wishwork.skin/images/3811056301/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:59.032Z","timestamp":1791495839032,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3811056301/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 429 Too Many Requests\r\ncontent-length: 117\r\ncache-control: no-cache\r\ncontent-type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":null,"data":{"size":117,"size_decoded":222,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"2dccf9a2e169c68dd4f3bd5ea163e45e","sha1":"4ddcf984285a5c544ed1132f5f6efd7a5d01b470","sha256":"ae138caf8767f7be2fe6f47f1663b0e2e28d903264707aa9b6f73bb7b223902c","sha512":"ba8e31094fda723fa66d589e229f240773f46493198b776240897e60998e7695c2865e17213fb3ed0e2756de8227c9271464ba64c5bc9448880d5f2a03cb4f57","ssdeep":"","tlshash":"7cb0928e99c5210fa4a00b607fc252ea7924a2b9a9c9703080fdbafa0010a20c82698d","first_seen":"2023-05-10T13:09:04Z","last_seen":"2026-10-08T21:44:30.707646Z","times_seen":549,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/favicon.svg","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.296Z","timestamp":1791495838296,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 977\r\nlast-modified: Thu, 01 Oct 2026 14:11:14 GMT\r\netag: \"6abe6a02-3d1\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":977,"size_decoded":1195,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a6a460a038506d944df53ca8753a0186","sha1":"59a85d7f57e24c78c9eb8bc96c12ea2ce71ef9ef","sha256":"437c25a5e7715b201c745c150ee80b5c03b2dd16b0d18bd21eddd314383be6ff","sha512":"2c465466207bfaf4f346b003fa770a863f15bd8c1a4faf11fbcad81866d23a6afca3c8e4a11cb817ba1dd014763e81b273dd34d20339bb591b415136a7e1371b","ssdeep":"","tlshash":"f911bd69d1ad892edb54c109ca78a075336d41d3a79ac304b04d6f3d1b600e79c5b3fc","first_seen":"2026-10-08T21:34:47.369175Z","last_seen":"2026-10-08T21:44:30.709932Z","times_seen":2,"resource_available":false,"data":null}},"time_used":136,"timings":{"blocked":79,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3103860889/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.787Z","timestamp":1791495838787,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3103860889/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 29224\r\nlast-modified: Thu, 01 Oct 2026 09:34:36 GMT\r\netag: \"6abe292c-7228\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29224,"size_decoded":29442,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0ecdfb496b417ddcabfeca206596565e","sha1":"eee825eb56991b9feaf7df50c1c6b5cf85e91157","sha256":"8c52b9c5c80a793b34592aa934aa6d036d4018b36c8b20dd75d3e3fa29b72268","sha512":"9d5662ceee5fcb55937758d6d4ad4bc57e44527ceb7bfc388a647d3f7b1d453258a6cc05912d4b0d3619fe2e179226ee05dc91c8cab3166e7529a9cd00f27e91","ssdeep":"768:ZCz/ol6Iwf30g0lpNqO8HZQ4lR81Pbqfk19AADzfpCGEu1pB:ZC7o0ISj0lpF2r38J0mDbrB","tlshash":"18d2f26e6db4ed352207dd605fdc3da0e87031d780db2d2152e1807a2a575dae3ce272","first_seen":"2026-10-08T21:34:47.266121Z","last_seen":"2026-10-08T21:44:30.711547Z","times_seen":2,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":83,"dns":0,"connect":0,"send":0,"wait":49,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/913345674/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.792Z","timestamp":1791495838792,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/913345674/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 44242\r\nlast-modified: Thu, 01 Oct 2026 09:34:30 GMT\r\netag: \"6abe2926-acd2\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44242,"size_decoded":44460,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c8859708b5756e5594b976314d708ab7","sha1":"eba69821c572ad1d07de52ea870f1866f54faf29","sha256":"b503b81e3a94da8debc8f24b587524c1993d23dfa5eb92f38967ea7e03d04ca0","sha512":"615e2787261f9cb415887dee25e02e11365fbdc72d1576e9dbda4687cd1e0a1290ce941a9043a01b63dea0b3f854d45c93b4eb9b288e9e9ceb7fdd18087aa868","ssdeep":"768:H5egnRxy8TeuC7ZHBxknfiUYplQKxEmHau2nb13863Qx+k8HFenzA1:HRvy8TeuC7RBOfillQyEm6uY863W+VFF","tlshash":"4713f107b7639d624b29191c7777a0da393025471389ce8f9930ac9a77a377f74ac0a1","first_seen":"2026-10-08T21:34:47.322777Z","last_seen":"2026-10-08T21:44:30.714232Z","times_seen":2,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":116,"dns":0,"connect":0,"send":0,"wait":63,"receive":34,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3767009639/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:59.034Z","timestamp":1791495839034,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3767009639/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 429 Too Many Requests\r\ncontent-length: 117\r\ncache-control: no-cache\r\ncontent-type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":null,"data":{"size":117,"size_decoded":222,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"2dccf9a2e169c68dd4f3bd5ea163e45e","sha1":"4ddcf984285a5c544ed1132f5f6efd7a5d01b470","sha256":"ae138caf8767f7be2fe6f47f1663b0e2e28d903264707aa9b6f73bb7b223902c","sha512":"ba8e31094fda723fa66d589e229f240773f46493198b776240897e60998e7695c2865e17213fb3ed0e2756de8227c9271464ba64c5bc9448880d5f2a03cb4f57","ssdeep":"","tlshash":"7cb0928e99c5210fa4a00b607fc252ea7924a2b9a9c9703080fdbafa0010a20c82698d","first_seen":"2023-05-10T13:09:04Z","last_seen":"2026-10-08T21:44:30.707646Z","times_seen":549,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/favicon.svg","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:59.120Z","timestamp":1791495839120,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 429 Too Many Requests\r\ncontent-length: 117\r\ncache-control: no-cache\r\ncontent-type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":null,"data":{"size":117,"size_decoded":222,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"2dccf9a2e169c68dd4f3bd5ea163e45e","sha1":"4ddcf984285a5c544ed1132f5f6efd7a5d01b470","sha256":"ae138caf8767f7be2fe6f47f1663b0e2e28d903264707aa9b6f73bb7b223902c","sha512":"ba8e31094fda723fa66d589e229f240773f46493198b776240897e60998e7695c2865e17213fb3ed0e2756de8227c9271464ba64c5bc9448880d5f2a03cb4f57","ssdeep":"","tlshash":"7cb0928e99c5210fa4a00b607fc252ea7924a2b9a9c9703080fdbafa0010a20c82698d","first_seen":"2023-05-10T13:09:04Z","last_seen":"2026-10-08T21:44:30.707646Z","times_seen":549,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-08T21:43:57.940Z","timestamp":1791495837940,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 3830\r\nlast-modified: Fri, 02 Oct 2026 05:55:46 GMT\r\netag: \"2fa8-65cd52ef8bde8-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12200,"size_decoded":4118,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (314)","md5":"6c020cafc66953233b9949930113d89a","sha1":"6e109d2117981b0850171ce9c84d4a49ae68cf35","sha256":"903a73d653094aa0270055ff26b3aa2c99a2b6eef4f9b805bf07f6b5cf4a157e","sha512":"1b575ce5cb1befb2efdb8ae1ce146d1c0e5e55532850f236220ae5991993ddb9098697139e8fb352542415db8b64cdfd98bf774ed2d31f0ad47f96255c133e10","ssdeep":"192:CrmYxo5UFKNzsAHbbO9VUQQDFecI+oZAlY8HJkXXtLWxJSsym:EIUkNzsAHPO9QFlFo2HJkX9LWxJSsym","tlshash":"2042946390b80a33131391c8279737197ae6dd47ea892810f6fd1ae25ffbd51a03b10b","first_seen":"2026-10-08T21:34:47.291238Z","last_seen":"2026-10-08T21:44:30.716861Z","times_seen":2,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":4,"connect":29,"send":0,"wait":89,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.580Z","timestamp":1791495838580,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://wishwork.skin\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 05 Oct 2026 15:55:52 GMT\r\nexpires: Tue, 05 Oct 2027 15:55:52 GMT\r\ncache-control: public, max-age=31536000\r\nage: 280086\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-10-09T21:27:53.773385Z","times_seen":311219,"resource_available":false,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":32,"send":0,"wait":17,"receive":52,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.617Z","timestamp":1791495838617,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://wishwork.skin\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 05 Oct 2026 15:55:52 GMT\r\nexpires: Tue, 05 Oct 2027 15:55:52 GMT\r\ncache-control: public, max-age=31536000\r\nage: 280086\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-10-09T21:27:53.773385Z","times_seen":311219,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/2106092851/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.780Z","timestamp":1791495838780,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/2106092851/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 17042\r\nlast-modified: Thu, 01 Oct 2026 09:34:24 GMT\r\netag: \"6abe2920-4292\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17042,"size_decoded":17260,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a8f0361bb9f07dec9af2376a0780b186","sha1":"ba3849bfe465d52c4edbce92656474533806dbc6","sha256":"8f16cab513d2c871c915e473c736ac612f7e35bc67cf57301d761e78c194a8c0","sha512":"5077fbe40ba527eaa6753d48e8342322b82833bffbec4d08098dd943526f5a5d8b19b40f6fbb9f67742d2aa46fa933e45c67ff530cb8aa831326e12123ecbdfd","ssdeep":"384:okuhwN6msV2hdiJSWGmXKy3xWwFF8c1QtDcWf3F:o2uaiJnPtQBcsF","tlshash":"1f72d03da4a1c5e5c6e21b341e2fa3ffec312e496a51c35799cbf34a630814a3161b87","first_seen":"2026-10-08T21:34:47.347335Z","last_seen":"2026-10-08T21:44:30.720638Z","times_seen":2,"resource_available":false,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":25,"send":0,"wait":71,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3449189293/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.987Z","timestamp":1791495838987,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3449189293/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 429 Too Many Requests\r\ncontent-length: 117\r\ncache-control: no-cache\r\ncontent-type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":null,"data":{"size":117,"size_decoded":222,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"2dccf9a2e169c68dd4f3bd5ea163e45e","sha1":"4ddcf984285a5c544ed1132f5f6efd7a5d01b470","sha256":"ae138caf8767f7be2fe6f47f1663b0e2e28d903264707aa9b6f73bb7b223902c","sha512":"ba8e31094fda723fa66d589e229f240773f46493198b776240897e60998e7695c2865e17213fb3ed0e2756de8227c9271464ba64c5bc9448880d5f2a03cb4f57","ssdeep":"","tlshash":"7cb0928e99c5210fa4a00b607fc252ea7924a2b9a9c9703080fdbafa0010a20c82698d","first_seen":"2023-05-10T13:09:04Z","last_seen":"2026-10-08T21:44:30.707646Z","times_seen":549,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":9,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/2943254655/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.989Z","timestamp":1791495838989,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/2943254655/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 429 Too Many Requests\r\ncontent-length: 117\r\ncache-control: no-cache\r\ncontent-type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":null,"data":{"size":117,"size_decoded":222,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"2dccf9a2e169c68dd4f3bd5ea163e45e","sha1":"4ddcf984285a5c544ed1132f5f6efd7a5d01b470","sha256":"ae138caf8767f7be2fe6f47f1663b0e2e28d903264707aa9b6f73bb7b223902c","sha512":"ba8e31094fda723fa66d589e229f240773f46493198b776240897e60998e7695c2865e17213fb3ed0e2756de8227c9271464ba64c5bc9448880d5f2a03cb4f57","ssdeep":"","tlshash":"7cb0928e99c5210fa4a00b607fc252ea7924a2b9a9c9703080fdbafa0010a20c82698d","first_seen":"2023-05-10T13:09:04Z","last_seen":"2026-10-08T21:44:30.707646Z","times_seen":549,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":21,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/apple-touch-icon.png","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:59.118Z","timestamp":1791495839118,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 429 Too Many Requests\r\ncontent-length: 117\r\ncache-control: no-cache\r\ncontent-type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":null,"data":{"size":117,"size_decoded":222,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"2dccf9a2e169c68dd4f3bd5ea163e45e","sha1":"4ddcf984285a5c544ed1132f5f6efd7a5d01b470","sha256":"ae138caf8767f7be2fe6f47f1663b0e2e28d903264707aa9b6f73bb7b223902c","sha512":"ba8e31094fda723fa66d589e229f240773f46493198b776240897e60998e7695c2865e17213fb3ed0e2756de8227c9271464ba64c5bc9448880d5f2a03cb4f57","ssdeep":"","tlshash":"7cb0928e99c5210fa4a00b607fc252ea7924a2b9a9c9703080fdbafa0010a20c82698d","first_seen":"2023-05-10T13:09:04Z","last_seen":"2026-10-08T21:44:30.707646Z","times_seen":549,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/styles.css","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.271Z","timestamp":1791495838271,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /styles.css HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 01 Oct 2026 14:11:12 GMT\r\ntransfer-encoding: chunked\r\netag: W/\"6abe6a00-6dac\"\r\ncontent-encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28076,"size_decoded":9081,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"e74348231488d249e2b3adf0b4ca68e7","sha1":"5bc73911b22b5a25e2a38b3fde5c803e7a6ebf5c","sha256":"2793ecbcc7c461c1747de7a207990b3dc470a536456fd7a57ae2a882e03d991f","sha512":"69fa3ec6a4fac85cf1a595fa01743763808cdcab8a141222bef8afb97c2ee06eed5663637046a43cb35c28df611cc816f25c2dd5ea779b113c2fa462b1b5003f","ssdeep":"384:mVEmUqWN10KIziNCh366RC958N0WIiqmZakk6VlkbfnznHg2O6nJ5AdIJi1ZB:GEDqWN1tHcIz8uhZTLHg2O6zW","tlshash":"dec2f9e56684e13e783bf065af5853de7218b003dc579bece851a1748ec7bf6097a208","first_seen":"2026-10-08T21:34:47.344672Z","last_seen":"2026-10-08T21:44:30.72295Z","times_seen":2,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3811211441/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.773Z","timestamp":1791495838773,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3811211441/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 21078\r\nlast-modified: Thu, 01 Oct 2026 23:14:04 GMT\r\netag: \"6abee93c-5256\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21078,"size_decoded":21296,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"84ca0ea77c2016af3c753dc1543c18b5","sha1":"e03c4a0b0095cab27f00991e232bf2f3844c3c2d","sha256":"024bcf2c7569d30f62f545f64e5beaec0132d6eed22b3e724d95da1c2542dffc","sha512":"a3d271c45fa6732b0ba768ac92b551280a77fd95165749c7cd3ffe1b0f69dc4438d70b4937e21975b4e4d2c4dc105ccd2846c011c3e25bd53b95c95dbbb190fc","ssdeep":"384:rZn6glNuP/klJlzSCf305M4Ba/f5lJVkNDTJVp4PtjyhmgffNw/j69Lq:FV645i5M4BcpkNDTJV4tuAGfNIu9Lq","tlshash":"7692d0828783aaa2c7707f97369358a3050033532d69c967b4ebda85e98f0c7ec1d437","first_seen":"2026-10-08T21:44:30.725236Z","last_seen":"2026-10-08T21:44:30.725236Z","times_seen":1,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3811216101/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.775Z","timestamp":1791495838775,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3811216101/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 32556\r\nlast-modified: Thu, 01 Oct 2026 23:14:02 GMT\r\netag: \"6abee93a-7f2c\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32556,"size_decoded":32774,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"caacea575a22a75fe982ca9cbf3c03e5","sha1":"a71575c06df81f6dc201d4199d888e10b0cefb2c","sha256":"3c671d6b26303105f458e1769c152a3d0f807a21bd4843e4d82c9809582aa4e6","sha512":"5963c644be86bd6dd57d02920f079af051d601f212151a84b2fca0b6bd165ea02ff36a23fad269878b876f8fc598d9d0a7f2fc620932b2444fcf0131fdc4779b","ssdeep":"768:+wCHIZ1Um86vorikAu+oxcmkWz0Jn/52dBbosU2RPMEI5:HnZ2m86vZTuVxhLanR27/UYPMEO","tlshash":"fee2f1ee8a7915d2d832831da436a3f7f0f2420a875a18fdf40ce45a753c925288753d","first_seen":"2026-10-08T21:44:30.728203Z","last_seen":"2026-10-08T21:44:30.728203Z","times_seen":1,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3289178454/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.803Z","timestamp":1791495838803,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3289178454/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:59 GMT\r\ncontent-type: image/webp\r\ncontent-length: 38942\r\nlast-modified: Thu, 01 Oct 2026 09:34:36 GMT\r\netag: \"6abe292c-981e\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38942,"size_decoded":39160,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"bbabdcf6b009599ccf841e293c62699f","sha1":"3b7cd981c5c4bac14b7e880a1dbfd26cbe4bdc26","sha256":"e150630b18a5ae95efc50a5bb0c1b9755644edc6e7dfa37b2b2bafa05b960f76","sha512":"e5fa642c6917f930984c7dc129fbbb4dc5cdb3e08903a331d05b4483f2c13071918cd9cdbfa8ea762bb29c89d8941b51c28ba74eb9325a8d8dd87f091cfe4e69","ssdeep":"768:RODj2aEu6Y0o1BfKBN4eWNkEZiUgGTBmGX05QM7qv0iEOwaDVecsIe:ROm3uBS4T/YGLM7w0TOzA","tlshash":"d003f1039e7293d54e409cf96088abaed910f1db49669827724f9f0cd4ca7d278f6077","first_seen":"2026-10-08T21:34:47.314006Z","last_seen":"2026-10-08T21:44:30.730736Z","times_seen":2,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":189,"dns":0,"connect":0,"send":0,"wait":56,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3457638060/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.992Z","timestamp":1791495838992,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3457638060/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 429 Too Many Requests\r\ncontent-length: 117\r\ncache-control: no-cache\r\ncontent-type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":null,"data":{"size":117,"size_decoded":222,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"2dccf9a2e169c68dd4f3bd5ea163e45e","sha1":"4ddcf984285a5c544ed1132f5f6efd7a5d01b470","sha256":"ae138caf8767f7be2fe6f47f1663b0e2e28d903264707aa9b6f73bb7b223902c","sha512":"ba8e31094fda723fa66d589e229f240773f46493198b776240897e60998e7695c2865e17213fb3ed0e2756de8227c9271464ba64c5bc9448880d5f2a03cb4f57","ssdeep":"","tlshash":"7cb0928e99c5210fa4a00b607fc252ea7924a2b9a9c9703080fdbafa0010a20c82698d","first_seen":"2023-05-10T13:09:04Z","last_seen":"2026-10-08T21:44:30.707646Z","times_seen":549,"resource_available":true,"data":null}},"time_used":79,"timings":{"blocked":50,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.619Z","timestamp":1791495838619,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://wishwork.skin\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 05 Oct 2026 15:55:52 GMT\r\nexpires: Tue, 05 Oct 2027 15:55:52 GMT\r\ncache-control: public, max-age=31536000\r\nage: 280086\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-10-09T21:27:53.773385Z","times_seen":311219,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/1599546257/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.794Z","timestamp":1791495838794,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/1599546257/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 28898\r\nlast-modified: Thu, 01 Oct 2026 09:34:20 GMT\r\netag: \"6abe291c-70e2\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28898,"size_decoded":29116,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c7f7c4908d5fbcdd2f0fb555f9aef039","sha1":"24edee741404f0422cc2ea71c5737460a8c45d7a","sha256":"f08a7ce0488bd2a8f20e4b0acf51cfbd8551b48d0feb76934591313998d60916","sha512":"184bb08fcc1f02a7908d4d25246da317e294bd0366eeabd967f7abca1d9eedea16b9f44fc88b1e70343ca7c6656afb8dad2f697d873d8ec986a7dfa9d1eb90c0","ssdeep":"768:RNVQN5krQBSGoOH/bm5sygq2FlwTf028VsZxK:S3kr17k/1Jq4phVCxK","tlshash":"51d2e1a53aac9ee03bf0db2d27b9e11c42850ca3dd44a636dc33aa96fb125895005773","first_seen":"2026-10-08T21:34:47.283342Z","last_seen":"2026-10-08T21:44:30.732961Z","times_seen":2,"resource_available":false,"data":null}},"time_used":172,"timings":{"blocked":117,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3390216900/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.797Z","timestamp":1791495838797,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3390216900/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 28450\r\nlast-modified: Thu, 01 Oct 2026 09:34:36 GMT\r\netag: \"6abe292c-6f22\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28450,"size_decoded":28668,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"36d0a8b2c641669bcd282e9d1ba81312","sha1":"3f2bcb54a769c98272564eef8427964909471c0f","sha256":"29e38eff26f400a8d2c5a60aaa9e8e6ba16c83ae8b1c68b880bd088a1bec55ff","sha512":"1b2f3acdef75ac6233446b23e99cd2c7a1e3acd66f4ab0d831746fbcf2bcfeeeb90b3f146853323a530814b58edfebdec14204e07fbb164addadded7bb9c3380","ssdeep":"768:pm34gJN8K/csKdTGL1GXNRFgCyZKeJuc+G7Wm3:g34Y8KTL1EPqCCFr7Z","tlshash":"f5d2e1016955a0da1162cbd8f006c99bc815afc7bed5e3a4ed28bcff47ce4e40292757","first_seen":"2026-10-08T21:34:47.3647Z","last_seen":"2026-10-08T21:44:30.734954Z","times_seen":2,"resource_available":false,"data":null}},"time_used":189,"timings":{"blocked":132,"dns":0,"connect":0,"send":0,"wait":55,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3269792550/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.980Z","timestamp":1791495838980,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3269792550/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:59 GMT\r\ncontent-type: image/webp\r\ncontent-length: 40342\r\nlast-modified: Thu, 01 Oct 2026 09:34:38 GMT\r\netag: \"6abe292e-9d96\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40342,"size_decoded":40560,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f5cc2576fa6053cde55d549f49aad883","sha1":"ae2156a9c3de36f4059b5b84986012f905b7cb3b","sha256":"b11685f1958f73aa0928037a6360038d5ba6b7dc72ef9c5ff861719a840428fe","sha512":"aa72cf2e4d6a70d399e9a61d0bb6481443f0ca03c40e5abbf4fc24393751288c2eaef55484b00c9ea0c7326a6a002553e5c3dff2099203cfcb89333d898516fd","ssdeep":"768:t6p3C5DOF4Nt3eoRxSyA7nVtyMCHMuVg9pJr4Qb8uwH227LEB:t69CNOFyuoVAzTtCHMuMTrzW2vB","tlshash":"a703f2499302b7279d98bdc03399df46f0168d4cdb8f32abd3fa478a9686d0b526046d","first_seen":"2026-10-08T21:34:47.277861Z","last_seen":"2026-10-08T21:44:30.737152Z","times_seen":2,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3763969739/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:59.036Z","timestamp":1791495839036,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3763969739/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 429 Too Many Requests\r\ncontent-length: 117\r\ncache-control: no-cache\r\ncontent-type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":null,"data":{"size":117,"size_decoded":222,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"2dccf9a2e169c68dd4f3bd5ea163e45e","sha1":"4ddcf984285a5c544ed1132f5f6efd7a5d01b470","sha256":"ae138caf8767f7be2fe6f47f1663b0e2e28d903264707aa9b6f73bb7b223902c","sha512":"ba8e31094fda723fa66d589e229f240773f46493198b776240897e60998e7695c2865e17213fb3ed0e2756de8227c9271464ba64c5bc9448880d5f2a03cb4f57","ssdeep":"","tlshash":"7cb0928e99c5210fa4a00b607fc252ea7924a2b9a9c9703080fdbafa0010a20c82698d","first_seen":"2023-05-10T13:09:04Z","last_seen":"2026-10-08T21:44:30.707646Z","times_seen":549,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wishwork.skin/","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-08T21:43:55.316Z","timestamp":1791495835316,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-09T21:29:41.546488Z","times_seen":18982225,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/theme.css","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.274Z","timestamp":1791495838274,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /theme.css HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 02 Oct 2026 07:49:45 GMT\r\ntransfer-encoding: chunked\r\netag: W/\"6abf6219-481f\"\r\ncontent-encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18463,"size_decoded":6331,"mime_type":"text/css","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (374)","md5":"bbf3c1be4264a8b37fa44340d94db12c","sha1":"62fe61f0d8a661a7412f0bfac0cbf43e822788be","sha256":"904232b24b2f81b3e8079a8ce8bbd385519d33e804b08e2a2f0a88ba28eec8ed","sha512":"5de0278331e87b2e48f9ab25489f3fd141cc95529c9e862a098319737dc0898d6c489446af9970ac7ad6c5e7e4bb232640f0ffc58c9a08746c4aec1aa5858b97","ssdeep":"192:zbdHakRr9R8S09O4yckuPRdOLdOpTFLCGPqo+KFlOUvtagLii+kxy2xf0xVX2R4s:v9UNsOJRqobrmi5bKxVXIHXkaIq","tlshash":"0982e8f4a540a03e7e13e5473b85a38e7268b416dd234be8dcab91648ac37fb463570d","first_seen":"2026-10-08T21:34:47.318501Z","last_seen":"2026-10-08T21:44:30.740326Z","times_seen":2,"resource_available":true,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":25,"send":0,"wait":79,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3811183292/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.777Z","timestamp":1791495838777,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3811183292/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 40240\r\nlast-modified: Thu, 01 Oct 2026 23:14:08 GMT\r\netag: \"6abee940-9d30\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40240,"size_decoded":40458,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"425c442460da1ce4369703f89fde811c","sha1":"900304e58dff18a6cf5c3d8b48de144c9e77909d","sha256":"7c7e34d594d3b95393ac8b40da68ff83746cb3e03f4ad50e25cc62805804dc94","sha512":"ee0a017d3bed9e14abcf967738bbce291c666f17349c8476ca2b61a9e0d1391b5064d06bf31ff63a18a75880529ded151f46a1bdbc84e57ba33324332805c7d4","ssdeep":"768:Ou+cbJNHS3p2NanEHHDlPkqAMhAT+0nke30Cvv5OzhX5bWQi7bX:Ou+cbLSZRq7p2T+0nQqOzXx8bX","tlshash":"fa0302d6d45ea895ba5635f441802ce40ef7831e0ef1a516e9c38bf608b8c48735e9fb","first_seen":"2026-10-08T21:34:47.300644Z","last_seen":"2026-10-08T21:44:30.742019Z","times_seen":2,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":86,"receive":58,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3264891092/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.784Z","timestamp":1791495838784,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3264891092/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 24432\r\nlast-modified: Thu, 01 Oct 2026 09:34:32 GMT\r\netag: \"6abe2928-5f70\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24432,"size_decoded":24650,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4d7c6a27876cbce2860522645191834c","sha1":"02c586a38d02be59cace4009a283afe616394c8d","sha256":"b5aa4e1f793db1dc21a993ca3ac2b621b217ac4f4cda399439a4477b14445cfd","sha512":"216dce670f0d06ec22bdc53a2c6aa3e2e2c87ae0c296a6e72f3b523e07bb2ce07804859bb6f2c5df9431b72e6d2bc53d739b4ad1d4b16fdbbef35275748fd362","ssdeep":"384:vMf8aNUgTl8eNn0wYNrF2wRBuXOP5haAv6zHjpNmiyfZQzZnxCxLtbF9S3rRYLSL:vMf8GUbJrFDX/DJv67jpQkwx5bF9S3rN","tlshash":"93b2f10e11f5613cd018d95307f1ab0ed215eae9cdf45923bdfac8cab8780e0fa95864","first_seen":"2026-10-08T21:34:47.362654Z","last_seen":"2026-10-08T21:44:30.743623Z","times_seen":2,"resource_available":false,"data":null}},"time_used":132,"timings":{"blocked":48,"dns":0,"connect":0,"send":0,"wait":60,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3264924527/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.786Z","timestamp":1791495838786,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3264924527/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 22672\r\nlast-modified: Thu, 01 Oct 2026 09:34:26 GMT\r\netag: \"6abe2922-5890\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22672,"size_decoded":22890,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"224822c4621ed0fda96033b793523ca3","sha1":"93c4d230027fb951d4064002f914f2bd80c406a2","sha256":"24972ed67953ec0aadcd0cb4883d61a3fdaa398f1fc5ce8c857a9b7c0fccf9a3","sha512":"e3e544aff7f69796b45692222dc9d45407d31be5b07842858fb23dbb13ae85141a4dcbfcb34bd707b4a36f506cc45933f003272878c98bb81a1f664105337e78","ssdeep":"384:slZnuNrtFZnqmM0gbN7ctkbnfgoqc3G6FFSvfx1CpoxIYviVHPMq+oyNuUnZlmqW:qyZUtbVBq6FFijCpPY/q+YanmqDnMK5C","tlshash":"7fa2e0ba93245d20ddcb85317ad15c3978e3c02508bfa6921d2870a40a766be3eadc75","first_seen":"2026-10-08T21:34:47.2979Z","last_seen":"2026-10-08T21:44:30.745703Z","times_seen":2,"resource_available":false,"data":null}},"time_used":116,"timings":{"blocked":56,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3264897504/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.799Z","timestamp":1791495838799,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3264897504/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:59 GMT\r\ncontent-type: image/webp\r\ncontent-length: 24780\r\nlast-modified: Thu, 01 Oct 2026 09:34:34 GMT\r\netag: \"6abe292a-60cc\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24780,"size_decoded":24998,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"38ddbf56b849786efea6b401ff08fc82","sha1":"260514b8f6488aa69630d4e03b8a62afa1c91555","sha256":"b899852bd7bbbdc2900fb5df871b3456308c27200d0fefab8cdb3bd576245bf3","sha512":"7d68b633ea8d007567add58e0a96c364f0e9b64d3f226b7894501134123d6392fc6d51bd398023244ebbd276096be73ee6bd06f91e938561a3e32610b0453f4f","ssdeep":"768:rNE9vcCxi1ptyqN5Cgz2oV4pn+HPdxGPJYo:r6v+ptyVgnVa+v6io","tlshash":"94b2f15d053b6dbc7cc2d76b042ac4fb58782c275cbd662b068b8939c95d8649ce0dc7","first_seen":"2026-10-08T21:34:47.275448Z","last_seen":"2026-10-08T21:44:30.748003Z","times_seen":2,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":172,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3237957369/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.990Z","timestamp":1791495838990,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3237957369/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 429 Too Many Requests\r\ncontent-length: 117\r\ncache-control: no-cache\r\ncontent-type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":null,"data":{"size":117,"size_decoded":222,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"2dccf9a2e169c68dd4f3bd5ea163e45e","sha1":"4ddcf984285a5c544ed1132f5f6efd7a5d01b470","sha256":"ae138caf8767f7be2fe6f47f1663b0e2e28d903264707aa9b6f73bb7b223902c","sha512":"ba8e31094fda723fa66d589e229f240773f46493198b776240897e60998e7695c2865e17213fb3ed0e2756de8227c9271464ba64c5bc9448880d5f2a03cb4f57","ssdeep":"","tlshash":"7cb0928e99c5210fa4a00b607fc252ea7924a2b9a9c9703080fdbafa0010a20c82698d","first_seen":"2023-05-10T13:09:04Z","last_seen":"2026-10-08T21:44:30.707646Z","times_seen":549,"resource_available":true,"data":null}},"time_used":72,"timings":{"blocked":44,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.615Z","timestamp":1791495838615,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://wishwork.skin\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 05 Oct 2026 15:55:52 GMT\r\nexpires: Tue, 05 Oct 2027 15:55:52 GMT\r\ncache-control: public, max-age=31536000\r\nage: 280086\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-10-09T21:27:53.773385Z","times_seen":311219,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/api.php?action=me","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.769Z","timestamp":1791495838769,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /api.php?action=me HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://wishwork.skin/\r\nContent-Type: application/json\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 13\r\nset-cookie: PHPSESSID=p4m3to88877iq3vokg0ln5euok; expires=Sat, 07-Nov-2026 21:43:58 GMT; Max-Age=2592000; path=/; secure; HttpOnly; SameSite=Lax\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store\r\npragma: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"p4m3to88877iq3vokg0ln5euok","quoted":false,"path":"/","expires":"2026-11-07T21:43:58Z","raw_expires":"Sat, 07-Nov-2026 21:43:58 GMT","max_age":2592000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"PHPSESSID=p4m3to88877iq3vokg0ln5euok; expires=Sat, 07-Nov-2026 21:43:58 GMT; Max-Age=2592000; path=/; secure; HttpOnly; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":13,"size_decoded":387,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"6d3600a46bb738376a1514eae93988bf","sha1":"3b78be6a9d9c7dfe5bc613d137c3f2cdc8ce6ef0","sha256":"2e7fe66d0f26a4cc5aaad5f34dba496c7988c175f79b24dcfa414a1dba289c0a","sha512":"e09a82f35923dea8be19633df341b29240143f583ffb7c10fdd8acb20a9c923870e0a0dcf93bc7299ea408659db53e153d2231e0b319a082dce500bd55a15b94","ssdeep":"","tlshash":"1c600000cc0300003000000300000003030c00c303000c00c030cf0000c00303030000","first_seen":"2023-04-10T14:09:19Z","last_seen":"2026-10-09T20:51:16.653321Z","times_seen":3768,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3454883588/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.790Z","timestamp":1791495838790,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3454883588/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 23344\r\nlast-modified: Thu, 01 Oct 2026 09:34:30 GMT\r\netag: \"6abe2926-5b30\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23344,"size_decoded":23562,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2e77f9b7eecf9ad31f62723e8efaef92","sha1":"7ca8851d162dc75cc60a57661d2b2c1c8d068b77","sha256":"1ad8a331561b73a8d454cd978ad49c496886336624f8e16a22dd2bdc043e3f80","sha512":"e215e4ac15027197f091658dc6fa72afbec07b373dc79e995a2e349730da71f67809cc0b58206cf3e364943c50f8b07ff2c2257391ea7e94410f66b7b070d8bb","ssdeep":"384:sh5A0mlF+RdtlSUrBKlD5vfGT4lEDOAFgvkFXNJbHW36pw0/Zqclw6Y3BMx99uJ:6mT+rG3vfGHfFgoNJi36pPZzV9xM","tlshash":"62a2e1e2d19b3aa0b0329dbab9a9848fbdc9d7103d151069358c33cd2f5933cf153a96","first_seen":"2026-10-08T21:34:47.35295Z","last_seen":"2026-10-08T21:44:30.750066Z","times_seen":2,"resource_available":false,"data":null}},"time_used":176,"timings":{"blocked":115,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3411433022/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:59.039Z","timestamp":1791495839039,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3411433022/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 429 Too Many Requests\r\ncontent-length: 117\r\ncache-control: no-cache\r\ncontent-type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"429","status_text":"Too Many Requests","fingerprints":null,"data":{"size":117,"size_decoded":222,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"2dccf9a2e169c68dd4f3bd5ea163e45e","sha1":"4ddcf984285a5c544ed1132f5f6efd7a5d01b470","sha256":"ae138caf8767f7be2fe6f47f1663b0e2e28d903264707aa9b6f73bb7b223902c","sha512":"ba8e31094fda723fa66d589e229f240773f46493198b776240897e60998e7695c2865e17213fb3ed0e2756de8227c9271464ba64c5bc9448880d5f2a03cb4f57","ssdeep":"","tlshash":"7cb0928e99c5210fa4a00b607fc252ea7924a2b9a9c9703080fdbafa0010a20c82698d","first_seen":"2023-05-10T13:09:04Z","last_seen":"2026-10-08T21:44:30.707646Z","times_seen":549,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3230701624/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.789Z","timestamp":1791495838789,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3230701624/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 31404\r\nlast-modified: Thu, 01 Oct 2026 09:34:28 GMT\r\netag: \"6abe2924-7aac\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31404,"size_decoded":31622,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"cfe61b45adff7f0b4c1112bb1594308a","sha1":"bd0683ffd70e8880147c13e3347dc335531afe66","sha256":"bd3661dda4b2a304882a8c2db2d35cf57cb9ce118d8599c7c189f64980600673","sha512":"e00d92b5ca2f5a517272330b6aa02fccf90f8888fe08f6f58bc77ffe013bfa39f6159e946e17593cec0830831d469799505aae9ffa97f8f36a658e9cdef04eed","ssdeep":"768:0ZYnlGNrLRVmtMnnMes1s3ra4aHbNgNZTzGrKYTGK:0WmrLWtMnMi7cHbKzTzHYCK","tlshash":"cae2f1cf1cda6348cd1269a778e836fb50f3da92612eff00c49515e4daea4b011db635","first_seen":"2026-10-08T21:34:47.33995Z","last_seen":"2026-10-08T21:44:30.751904Z","times_seen":2,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":95,"dns":0,"connect":0,"send":0,"wait":57,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/data/items.js","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.280Z","timestamp":1791495838280,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /data/items.js HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Thu, 01 Oct 2026 23:17:50 GMT\r\ntransfer-encoding: chunked\r\netag: W/\"6abeea1e-82532\"\r\ncontent-encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":533810,"size_decoded":146896,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"49463ae7caa26677a63b3c12fb953993","sha1":"522e207665d31accfc19a9f8df0224435130e93e","sha256":"7e4ed0ad708977e1646dbef4a9d0316d336586d17f4bb170f2efd02cfbcbcf78","sha512":"1145461ca6862d9c337ec79175f4376bc622e9bac7ce45e1b02cb77190db1e7435d04fe35cff560a8a5e1c6591c3221daa9c25c681b83036ef8b762efa3dc85b","ssdeep":"1536:JeU2eQgQe4igevMU3SbOUqeqUJHEX832w1edBUFT+Qmlz9nC1rAlUDmFInEHfmGo:rH8xvXvtDoWj2eHfkXJEtvOkTwnI","tlshash":"38b4eb7785102f8b0bb891e97c5ea24ef261972f44429647f73cd14cdff12e360a2a69","first_seen":"2026-10-08T21:34:47.355557Z","last_seen":"2026-10-08T21:44:30.753156Z","times_seen":2,"resource_available":true,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":27,"send":0,"wait":86,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/data/overrides.js","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.289Z","timestamp":1791495838289,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /data/overrides.js HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 02 Oct 2026 06:01:50 GMT\r\ntransfer-encoding: chunked\r\netag: W/\"6abf48ce-87a\"\r\ncontent-encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2170,"size_decoded":1327,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"ef4cde30004c5d239731470a1980b9d5","sha1":"cdaec712f301009bb3b4932c7011bb9812eefa9a","sha256":"5761adadc0eb7673154f8858423e2c81271947f118c028284a13afbe01a0b510","sha512":"0754165accb3268ff4a79392532067ba6f0e1616f2b7de47f6bd3f0079e3280f71435bfa7a241d86970d8756480d16c3bffeb702ca2017acd120db4e36e932f7","ssdeep":"","tlshash":"3b413520e29030fb0218f093dd0c664dbdf55dff2aba52057d5cba7aa7e5571423911d","first_seen":"2026-10-08T21:34:47.320887Z","last_seen":"2026-10-08T21:44:30.754244Z","times_seen":2,"resource_available":true,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":28,"send":0,"wait":80,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/app.js","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.291Z","timestamp":1791495838291,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /app.js HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Thu, 08 Oct 2026 15:47:48 GMT\r\ntransfer-encoding: chunked\r\netag: W/\"6ac7bb24-651b\"\r\ncontent-encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25883,"size_decoded":9731,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"bebafe0ba1fd4721795f8e62a8b31f4e","sha1":"929f229581062f9d33fcf789ed2024d5b7fcd3d5","sha256":"c4e19890351ec1fa614235df6bbd830a07a1b9ec2a2b76543b5eb4e426c27da1","sha512":"a59b17cc0bfd8c618b55ed091225da0cb3a7dc4d83c20932538a0307ad8c3d53dad49c15ab58dcb3eb1b42cffd8a9aa4ff7c64bfdd1d63194ed4a07548522bfa","ssdeep":"384:1p0eEAcS79yDRZBUplR4FXLeYfY8P2VGNwDzHukAQv2DR8Yqd:1p3x9URDBLeKYtVewDzOkm/qd","tlshash":"24c2752af9ab25364533b039ab4f9118baf6041b2185cd107d8cc8996fb8c7953bdddc","first_seen":"2026-10-08T21:34:47.337658Z","last_seen":"2026-10-08T21:44:30.755157Z","times_seen":2,"resource_available":true,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":28,"send":0,"wait":86,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.584Z","timestamp":1791495838584,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:48 GMT","end":"Fri, 11 Dec 2026 20:01:47 GMT"},"fingerprint":{"sha1":"CE:B3:C9:86:04:78:55:83:CC:52:A9:C8:01:3D:FB:40:04:EA:65:79","sha256":"BB:17:4D:EA:95:BB:1E:04:F2:B9:A8:63:B5:85:90:0D:94:A9:44:9C:40:E1:6A:B2:0D:4E:92:6E:85:B2:49:E9"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://wishwork.skin\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 05 Oct 2026 15:55:52 GMT\r\nexpires: Tue, 05 Oct 2027 15:55:52 GMT\r\ncache-control: public, max-age=31536000\r\nage: 280086\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":49345,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-10-09T21:27:53.773385Z","times_seen":311219,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":30,"dns":0,"connect":0,"send":0,"wait":21,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3533292433/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.771Z","timestamp":1791495838771,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3533292433/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 17698\r\nlast-modified: Thu, 01 Oct 2026 09:35:42 GMT\r\netag: \"6abe296e-4522\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17698,"size_decoded":17916,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"72c5bdb379eee16d74b8314fabc013ba","sha1":"4bd37f424cc17d1b3fa07022e95e5a5dc6da33df","sha256":"dad4cc8d3ce01825599f53cc4cde28766716561e1d1f09743a57de288390d63d","sha512":"8a4d9b73de42208eab7af5639d65c41af713e7640e145f58cc0b5b59e897eaa0768e74fee30a577d18885e194cb2fba4fe8b35d76466e6b8e974e7992c23aded","ssdeep":"384:IcE1PGcSt/XnPuLkJwjANdCNEX+xo1rX96EMcJwZIL:IcE1PRKvnPuYJ4GXXJMc+qL","tlshash":"c282d081fa505339f9b2b47d60fe2b735e1e00a0a05f9499b041617defc05742a6eee5","first_seen":"2026-10-08T21:44:30.756376Z","last_seen":"2026-10-08T21:44:30.756376Z","times_seen":1,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3624217440/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.802Z","timestamp":1791495838802,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3624217440/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:59 GMT\r\ncontent-type: image/webp\r\ncontent-length: 47226\r\nlast-modified: Thu, 01 Oct 2026 09:34:40 GMT\r\netag: \"6abe2930-b87a\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47226,"size_decoded":47444,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"88688594d17f676beb7f2a2a99643a5c","sha1":"21c6c0c48a5bd338782358af45fe711662e5a5f6","sha256":"a2c5ce210abf48c496fdfe1da6f2be14533957fd6e1906ec96d2540719f211b0","sha512":"7f8c21b3367b4a6d77d994dc9c066565b88157a7f3921d72a32527258846fa23edf7080bc11e36ecd185e69283dd91fc8f643626e868b9a31c51db662cdc9b1b","ssdeep":"768:4WSnNskAcO8M5iDeI8f649nLJBTcRrxz0tENqBJOwKIQCY9+ELkl+Rw3YDaR18ai:ReikQniDeI8DnTYr1TIhGLLk67DG55+","tlshash":"9e23f2276e181ca6322e7cc7ce8960a543fcea74290dfd9b324e3a0762755fe3544746","first_seen":"2026-10-08T21:34:47.326332Z","last_seen":"2026-10-08T21:44:30.771449Z","times_seen":2,"resource_available":false,"data":null}},"time_used":234,"timings":{"blocked":176,"dns":0,"connect":0,"send":0,"wait":57,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.266Z","timestamp":1791495838266,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:49 GMT","end":"Fri, 11 Dec 2026 20:01:48 GMT"},"fingerprint":{"sha1":"E3:3D:17:9C:78:F1:DE:68:C7:E6:BB:8F:08:DC:78:F3:9D:DF:F2:43","sha256":"EB:D6:1D:9A:76:0B:5A:3C:08:74:83:6D:AA:A7:F4:B3:0D:17:8F:4F:3E:6B:9C:91:6C:5B:9E:F7:08:1F:00:62"}}},"request":{"raw":"GET /css2?family=Inter:wght@400;500;600;700;800\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Thu, 08 Oct 2026 21:43:58 GMT\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12635,"size_decoded":1486,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"c326a313eb7727f3c0a99d9ee5421be3","sha1":"da5da24173ba533db05f76ecf8d7a75dad68e205","sha256":"d747e2beeeab9b73702a98c58fa3b7e18ad2dea9c9a7308f1d66e878eac1d79f","sha512":"848f55aacae074ccc19495b12eaa500c128da29ec7d2194115a5181f513ae3e338e9bada5e35dfeb2a3698501c67c0de8878b272855e9425b4ec5126ec07ba77","ssdeep":"192:9NNIxO34OxvENOPCO3/NxoNNryfO3iExBONEhYO3RrxSfNx0NO3kCx7x:vXyMopi+s7X","tlshash":"83427892002ba400ab971dc263cf7f3aaece50896085d1b95ffd0dc59ceed66436876d","first_seen":"2026-10-05T17:59:48.819657Z","last_seen":"2026-10-09T21:15:25.093467Z","times_seen":294,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":14,"send":0,"wait":31,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3264923557/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.783Z","timestamp":1791495838783,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3264923557/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 24924\r\nlast-modified: Thu, 01 Oct 2026 09:34:26 GMT\r\netag: \"6abe2922-615c\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24924,"size_decoded":25142,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"aba5e9cbe2ba4c2655d6cbd66a6d6c90","sha1":"a998a5033f9a8ccd3423cd188b8131addeb2eb25","sha256":"81b78e20c142355870ae3b5b6c8f33804bb43fa8caa5d41b641ce9926528f039","sha512":"f664dde3b1acdf031d3eb63a2a3178a2ce5ac42959b60568c97d28c272d5f11ec2e977cdb2a8f4b64bea12a1ab539d837e227a1c37555ccad2c47479caf48de2","ssdeep":"384:Gnm4LUfpp8jF6h6VxE/CepJ2/TogXshpYYFGoQjjSWMaG0cgQ/TLew:btp8/A/C+Co2WIjGOcRT6w","tlshash":"d4b2e180b70fda91a9e221cbc0372bd0dfd35cbb468add94c51bca5e3d94785c914a94","first_seen":"2026-10-08T21:34:47.324542Z","last_seen":"2026-10-08T21:44:30.774801Z","times_seen":2,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3405399898/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.795Z","timestamp":1791495838795,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3405399898/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: image/webp\r\ncontent-length: 26970\r\nlast-modified: Thu, 01 Oct 2026 09:34:34 GMT\r\netag: \"6abe292a-695a\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26970,"size_decoded":27188,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 555x312, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"15f577fd62825e7ac3611b259a773d7a","sha1":"6a78d07af048b481b3dba76d198e75fa204491ed","sha256":"5e98e04f8c0a1e60916fb993d86574a1008a11092ae969e22d6d6872fc53cfaf","sha512":"458a074a240d37630212755c843c64b7040e751ff454806e610fbeffa9a36834d09018fb5da79c769aa4df5817a8617b23fc162ed75bd67c7b16dbe27d28a1e1","ssdeep":"768:v8/aFO/rGc4wkB6tFzvpX6TleC5ZcFGuMGIbNlUmc:vI6cZ5pKTocZIfsz","tlshash":"32c2e16369e7f409d86173440f4dba57d860da48430ab4fbb91ebe1821b6fec4ad7470","first_seen":"2026-10-08T21:34:47.311974Z","last_seen":"2026-10-08T21:44:30.7766Z","times_seen":2,"resource_available":false,"data":null}},"time_used":190,"timings":{"blocked":132,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/images/3512436398/thumb.webp","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.800Z","timestamp":1791495838800,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /images/3512436398/thumb.webp HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://wishwork.skin/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:59 GMT\r\ncontent-type: image/webp\r\ncontent-length: 15968\r\nlast-modified: Thu, 01 Oct 2026 09:34:32 GMT\r\netag: \"6abe2928-3e60\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15968,"size_decoded":16186,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 400x225, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c2181079d00fbab1c22e0fa28d094883","sha1":"d7418e1c1ebf1909140bacae5c7a04ce83a97681","sha256":"7a5eba678ba72416989924a75fb4d9a011667d7dadf99b03af23675c04049ee8","sha512":"1a6efe979843be2ab585b388ee2469e30a1f6b731f4aec5296438eff5da004ddf8ee25a2f778ebb55b936a7dd7244539aedbc6c13b0b5894247a1e8b7a58a730","ssdeep":"384:nIQcf0qPJIL6qUjRo6FvJ2S549k9tVyFHM0PyASV:IJNPlqUj62xBJ9wM6pY","tlshash":"1e62d09355af4f21769050f5e1240df41362d2a86ebd320c5dfba4be9a39aec921f0c6","first_seen":"2026-10-08T21:34:47.367038Z","last_seen":"2026-10-08T21:44:30.778153Z","times_seen":2,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":176,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"wishwork.skin/api.php?action=votes","fqdn":"wishwork.skin","domain":"wishwork.skin","tld":"skin"},"ip":{"addr":"154.86.119.220","port":80,"asn":0,"as":"","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://wishwork.skin/","date":"2026-10-08T21:43:58.853Z","timestamp":1791495838853,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /api.php?action=votes HTTP/1.1\r\nHost: wishwork.skin\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://wishwork.skin/\r\nContent-Type: application/json\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nserver: nginx/1.30.3\r\ndate: Thu, 08 Oct 2026 21:43:58 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 4529\r\nset-cookie: PHPSESSID=5capqaqfek5hljlqn5bkh7n851; expires=Sat, 07-Nov-2026 21:43:58 GMT; Max-Age=2592000; path=/; secure; HttpOnly; SameSite=Lax\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store\r\npragma: no-cache\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"5capqaqfek5hljlqn5bkh7n851","quoted":false,"path":"/","expires":"2026-11-07T21:43:58Z","raw_expires":"Sat, 07-Nov-2026 21:43:58 GMT","max_age":2592000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"PHPSESSID=5capqaqfek5hljlqn5bkh7n851; expires=Sat, 07-Nov-2026 21:43:58 GMT; Max-Age=2592000; path=/; secure; HttpOnly; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":4529,"size_decoded":4905,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"23f959e17c2ba7c093fe93fbd5355de8","sha1":"6880703bffea7a60e50621a168c10204bad60a33","sha256":"570ff2ced32f9eb91a797367e53c00146ee99932e6e4355361abfad0ca05f35a","sha512":"69c62a2c70ac493b4449f9cc919a04b5a43ff6f4d49dfeeecd5bf4bcc3ced11834b565be4179f9b0ad30670d6411cc1d3007447bc3c1602384d89e4c265efff6","ssdeep":"96:kTTRNSUM8TtY8STdS9gPnhNSw/bVRbgq26GQ07TIf:++8S7TdSoww/J72pQ0wf","tlshash":"0b91d0d1af9c19b980818fb66ed857bc347d48d6dc948adbc904ebcc37a14c6b47e824","first_seen":"2026-10-08T21:44:30.781663Z","last_seen":"2026-10-08T21:44:30.781663Z","times_seen":1,"resource_available":true,"data":null}},"time_used":68,"timings":{"blocked":4,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-08","alert":"Sinkholed","trigger":"wishwork.skin","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}