{"report_id":"0a10fa8d-735e-4cf2-9590-fa7afe4a548a","version":6,"status":"done","tags":[],"date":"2026-01-26T11:00:11Z","url":{"schema":"https","addr":"northwesternunion.com/","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":0,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"northwesternunion.com/","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"title":"North Western Union - Dedicated to innovating, simplifying, and humanizing digital banking.","dom":{"size":983,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (982), with no line terminators","md5":"dfd111f818a6295a65c5eebcc934146a","sha1":"8376f2d50bb606a602dd830ee9dbd4eb5a83ae63","sha256":"079aa2d4e23a2481aa18bafef43e94c6cfacbd3dc846cec88f3c8e4f35063faa","sha512":"22293f679e643bad4cf523f63dfeb9e206f993f5d1a89878dcdd8eed65d3bd5b607c42e0c9a76d931915a2a997e331234adeeec33e863fc994a3fbd2900c169b","ssdeep":"","tlshash":"cd1125719088241e9352d188e0e1372db3c3c90dc5a58ce6765825b2f1c4b36985b9fc","dom_hash":"domhashdda2f72fae377190c818cc3070d0de92","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"northwesternunion.com/","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":0,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-02T11:00:11Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"northwesternunion.com","ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2025-03-03","domain_rank":0,"first_seen":"2026-01-26T10:38:57.478933Z","last_seen":"2026-01-26T10:38:57.478933Z","alert_count":140,"request_count":70,"received_data":2637218,"sent_data":84298,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"GSAP","description":"GSAP is an animation library that allows you to create animations with JavaScript.","website":"https://greensock.com/gsap","common_platform_enumeration":"","icon":"TweenMax.png","categories":["JavaScript frameworks"]},{"name":"OWL Carousel","description":"OWL Carousel is an enabled jQuery plugin that lets you create responsive carousel sliders.","website":"https://owlcarousel2.github.io/OwlCarousel2/","common_platform_enumeration":"","icon":"OWL Carousel.png","categories":["JavaScript libraries"]},{"name":"Popper","description":"Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.","website":"https://popper.js.org","common_platform_enumeration":"","icon":"Popper.svg","categories":["Miscellaneous"]},{"name":"jQuery:3.2.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Bootstrap:404.0.0","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Tidio","description":"Tidio is a customer communication product. It provides multi-channel support so users can communicate with customers on the go. Live chat, messenger, or email are all supported.","website":"https://www.tidio.com","common_platform_enumeration":"","icon":"Tidio.svg","categories":["Live chat"]}]},{"fqdn":"translate.googleapis.com","ip":{"addr":"142.250.74.138","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":6317,"first_seen":"2012-05-31T07:21:21Z","last_seen":"2026-01-26T04:36:08.768233Z","alert_count":0,"request_count":6,"received_data":376845,"sent_data":3144,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":146047,"first_seen":"2012-05-29T15:36:17Z","last_seen":"2026-01-25T22:28:03.589555Z","alert_count":0,"request_count":6,"received_data":69788,"sent_data":3217,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-25T22:17:37.642954Z","alert_count":0,"request_count":1,"received_data":12775,"sent_data":541,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn-cgi","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2024-10-17T14:18:32.470193Z","last_seen":"2026-01-22T04:27:49.199331Z","alert_count":0,"request_count":2,"received_data":0,"sent_data":916,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-01-25T22:30:32.196824Z","alert_count":0,"request_count":5,"received_data":3455,"sent_data":2479,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"code.tidio.co","ip":{"addr":"104.26.0.115","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2014-06-01","domain_rank":120056,"first_seen":"2014-11-27T09:26:14Z","last_seen":"2026-01-21T16:10:10.93191Z","alert_count":0,"request_count":2,"received_data":1008,"sent_data":884,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-01-25T22:14:35.458366Z","alert_count":0,"request_count":4,"received_data":154362,"sent_data":2095,"comment":"","tags":null,"fingerprints":null},{"fqdn":"translate.google.com","ip":{"addr":"142.250.74.142","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":609,"first_seen":"2012-05-30T01:30:32Z","last_seen":"2026-01-26T06:54:43.517877Z","alert_count":0,"request_count":2,"received_data":84034,"sent_data":954,"comment":"","tags":null,"fingerprints":null},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.194.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2026-01-25T22:46:21.910908Z","alert_count":0,"request_count":1,"received_data":70232,"sent_data":470,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}]},{"fqdn":"www.google.com","ip":{"addr":"142.250.74.100","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":22,"first_seen":"2015-05-10T13:11:19Z","last_seen":"2026-01-25T22:25:49.134356Z","alert_count":0,"request_count":1,"received_data":739,"sent_data":449,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/contact-form-script.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"250bc40cc9bf0311ff49a31cb3fdd96f","sha1":"75b049495fd4ad8f8dba66abef363b74fa50b326","sha256":"01f88dcee3ea695865770808ba43f18d9b0a0db51696c39d69ea2a607c108e78","sha512":"7ba4df3992f99eb5cf3fc7ac3e4977218b0fe6d57912885197931701943e4a0d33d36971b70b656090d84bce351fccee973727bff9d85294c9dcc7d1c5350487","ssdeep":"","tlshash":"1811d012341429d9033b2bf9700e3602b3711a34c9bde91520b0b9cdbf78d9836a3316","size":895,"data":"","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.031863Z","times_seen":1527,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/aos.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"a01f9089e8301e9eacfb9d029dc0ca5c","sha1":"165152546121aaaf96c19418908cffe3630a2336","sha256":"4460f1596174d06cca957fdaca2c71e1a377cf1d6f07ee4c75ffb3bf3fc97a03","sha512":"a90277dcdf97d7decdc3ee3546ff80d537a779d7c70a44b6fdc0059df4c131d92af5336ba238b3f3e7c5dcd721c283616a1a54338203864479d47b120aeae80b","ssdeep":"384:3IkfNaayGbHbcggNFUWTgZeo1sa6XCZy54:4kfNaayGbHbfgNFUWgwAslXCZy54","tlshash":"5552e7dc3681f0a617a794f7826f600ff2f14834245e90a0d269c4e67db58ae8673f5e","size":14243,"data":"","first_seen":"2023-03-07T01:35:54Z","last_seen":"2026-07-26T06:29:09.081772Z","times_seen":11414,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"75606a24bd728e5d7d7256fbb679bc26","sha1":"7bfbb31c174ab2a6f4c68c9852c8444c075eab43","sha256":"9932726d2c87611c904eb0b04d822e785cd73f693838aa2cae3fc90a7d8d7746","sha512":"323a9930f67a978713ee419824630ccd74ec99274ead49c8ab87eedc33d5bf4dcc9cd681961483dbef9181b8c884fb7bff7eb579d12e5ac90d194caab6167dc9","ssdeep":"","tlshash":"2ec09247f5b01a4b049ae20ae387488c72bc8509463a4e292791a0ca3eb3f9d070e1a8","size":134,"data":"","first_seen":"2023-03-07T01:02:05Z","last_seen":"2026-06-25T23:48:49.64661Z","times_seen":3253,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:srcdoc#212","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"888a21ab7fc56d220a59dd25a83b18b6","sha1":"3bc9b8d495cf8e016aadf7e2bba091f2bd8b7188","sha256":"18c0d112e350349ca7390bc25c50a5fc92e9dc9b63416147c7e57851d105237e","sha512":"3dd8c3099c3300b3f74ffbe65e93e383d5c31087fb362f08bb241107c1061ef7dc8b61113851723a8588b54465c38056721341402f6a0072adce178ed3daf86e","ssdeep":"","tlshash":"b73147cdbbb7e0554272209a992f860bf17a2577981cd050e555ccd0fc70e9b447de14","size":1713,"data":"","first_seen":"2025-06-11T00:07:11.79824Z","last_seen":"2026-07-26T06:18:42.894699Z","times_seen":37081,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/fancybox.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"5903cd4e4bdc6c28ece32e469b887a8a","sha1":"825baf2b74a47eccb7b3f439fe58da710b84a2c4","sha256":"c563abe9b3e16a2461415597e352e306678e093e2078d6f3b9618d902b1ad2c7","sha512":"9562ef7d089c8ebd39a3978cdac3266643a4a184ebb122598b9991b8c9dbbcd61e4aae736bc2e1a84ce6edd97d6f671fb366ebc802b9a8170cc82d510ffbd3b9","ssdeep":"1536:FUtGulsqqQzeFuouppK0WFVnsQrNz7M4HJ3t5oSKN1fQq58cTJ7PBTf:cGasqqQzeFuoubK0WrNz7M4pd8qq58cH","tlshash":"0663f89fb610702582bb0594a30f560ed1377116f10284fa78bcd4d55ae4fc922ebbfa","size":68446,"data":"","first_seen":"2023-03-09T06:26:16Z","last_seen":"2026-07-26T06:29:09.035019Z","times_seen":1567,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/odometer.min.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"cbbe383a299d4cd3c5afd850e23b93e2","sha1":"a57fab98eed3ee4da231031c823c0dfe71435e5d","sha256":"b98842a571aa1f32f8797a9d08186bb021f258925a8db4fe57d60129b858b1ec","sha512":"85b7267f38755128dff6d6435f050b949d6b99c72290c00d6813b16207c8e3e70ae01300f4269fe28df87960be5ef2211c3ce4929ea36ae866bb0e6ff7f849e4","ssdeep":"192:kABzlvQK8QecCHAOcu2a+OdI5s/GMb8XuulT:vBhv18QecCxVxz+7dlT","tlshash":"3b228580ba11a725835372e151bf0609b7bb99aea404401db67c9dd9be29c38e12bf74","size":10264,"data":"","first_seen":"2023-03-07T12:27:14Z","last_seen":"2026-07-26T06:29:09.07767Z","times_seen":2936,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/_/translate_http/_/js/k=translate_http.tr.no.Jvw2x7oPD4E.O/am=AAQD/d=1/rs=AN8SPfrn9Mop7ahbtpv7AkykkR_oF0NHtA/m=el_conf","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"23d0583afa6762f38c7ca574804885c8","sha1":"a7c2fb85f7ceddffadcd6314a894a19ab2fea25d","sha256":"96ebfd199ce98a52df20ab3ca7860c5c068fa776d81a994eee69df6599a57802","sha512":"77a2cb18d4880af5c1eea0314f98609a2d756398aef0df2d4ba96c7e0556747dfc527a8b0ee5f9265bff9cf3f8b8e8d8598543981c0fa03c4ee661429bb4656a","ssdeep":"1536:X3vdWjCj72+e9JCTUHdBjHvK4eb1wh3N4eOdDNeziwwNWr7:XO+e9J3jHvK4EJgzio7","tlshash":"c283b7ccb6a670658263f5b5413f000eb23f59a9f8084dacb288d8e1adf4959417bf7d","size":81716,"data":"","first_seen":"2026-01-26T10:26:29.426237Z","last_seen":"2026-01-26T11:00:14.393265Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.2.1.slim.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.194.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5f48fc77cac90c4778fa24ec9c57f37d","sha1":"9e89d1515bc4c371b86f4cb1002fd8e377c1829f","sha256":"9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398","sha512":"cab8c4afa1d8e3a8b7856ee29ae92566d44ceead70c8d533f2c98a976d77d0e1d314719b5c6a473789d8c6b21ebb4b89a6b0ec2e1c9c618fb1437ebc77d3a269","ssdeep":"1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT","tlshash":"b663d5d9b2c67062db7730b950bf410bf07a98dab44c8c60e198d8d47d78a99817bf2d","size":69597,"data":"","first_seen":"2023-03-07T01:02:43Z","last_seen":"2026-07-26T06:29:09.039477Z","times_seen":80614,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/jquery.countdown.min.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"76a923d3d69255c45cd24bf9b100244f","sha1":"eb3c96f9901692f1a03500ea632963a16afdb985","sha256":"8f195573d6fa06641814b476fea2b92579c983cac46d683f356238207692c9f5","sha512":"b97bed03f0e8868df19d9e2437158b89f06a46827af8876f616c8f42786d145105964e8518d8bad9eece23cd9c7a4767f39861488c5410ab42ffc7e20cde44a4","ssdeep":"96:GBXpuplQHIwbeRFMSiM3jG6Ghdynv/2bBqz2eJxMxHxqxAxixw3xexIxrxAxW7qf:rQHnUpxGhdBqztJxMxHxqxAxixw3xexx","tlshash":"b9b1a5ceb3b213d508e553a201ae1116a27bf15be4d6001cb5fceac87a75c9d606fd78","size":5360,"data":"","first_seen":"2023-03-07T01:28:01Z","last_seen":"2026-07-26T06:29:09.032628Z","times_seen":10315,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/jquery.appear.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"80d1c754b36f693ea7de8d608acc4afe","sha1":"10736302703a32d7682359a36226f341c8982daf","sha256":"b57506318dccce1f06d2545f2db1bead5d46acb07df071aee7651d2c3013105d","sha512":"53f2b2c87a37679c54ae6e4adec6ab5e38aba31bf9ad51c69ada851d85d3b6e9d5cb3a770986d2584203d4f55fe6f03acbc0314afd99d536d70fb020847d68c2","ssdeep":"","tlshash":"0e21a8ca38c6bce583fb311c562f72421161913f574299a31ceadd7c35a6c913c13e68","size":1198,"data":"","first_seen":"2023-03-07T17:48:49Z","last_seen":"2026-07-26T06:29:09.043151Z","times_seen":1580,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/main.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"c36261f13ab72adcc6d121b42ecf7527","sha1":"c3797740ed1bcf47c268153320a1d04cec5d014c","sha256":"087aa918d5cd7d8340a2facc168e57245932b0a5f668f6249a45727b7868da1c","sha512":"a61e110a84815d8b4cb3bd2158daad9f9e12a20c95244c7d099b8f714efa5aa4ce48b72d699e4a08e6fdb7712bab17c7521586f52e18d683585df2f4c530c729","ssdeep":"48:YcKnGmRenN89Di9ooisW9ooiEM//PPBlLMeBlLqPBebfH0Yujmwm8Q+03iMbq1x5:YGOZ7W3vTLMyLqk9+0DeLfa+TBdD/","tlshash":"56b1864e712030ab94ef331598df6a44bf3b1910d700e999e2b641797d6890fbcb3a6d","size":5498,"data":"","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.049792Z","times_seen":1404,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/bootstrap.bundle.min.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"52a78545b39d3c5ceeabbac8cbe46cc0","sha1":"99e4421a2f4de040de5905bc15cd45d291ded586","sha256":"120666e01d671db172cecd87aaaed5cb0feb2da24d971c291fe1b8e0f64b18ac","sha512":"22cde83ff9ed88611b9307db3ec6604683d958c3d8caf879220f60146ff760d60dd5769cc5accb9655e269c21c2829fab47ad0d57963714ad435a3c4db28fc59","ssdeep":"1536:P+pbTNR2t4NEdiK5J2w8gGzjJVPOW7tI+r9ixR2nwZ7:u36WJr9ixF","tlshash":"3273c5493254b8730ade45a68037470bf3265994b14b802cb5bcadde2a3dd8672b7f7c","size":78085,"data":"","first_seen":"2023-03-08T09:18:43Z","last_seen":"2026-07-26T06:29:09.084565Z","times_seen":2837,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/tweenmax.min.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"3ebfc60317f7c7439949d5728c2e7905","sha1":"6bdc6e3e92cf447dc3922977d923b2901e36640d","sha256":"db1047e16f9ed072dbc343334fb2dde5f14c486676495bed4e592d75dc73522a","sha512":"dbf9d706a05c8b5215e73702744e075522cd0641e1a9a6566004866681eb6d3e55e5d8cf47829a2c6bb85f9a64d25555efe9b65c8c6614332177753583d142c7","ssdeep":"3072:wAcorGC89zpEosfUfR3Hb9jLYQz3Xk9kqJaR1MfgO4553Njx849GXIFsHtsznbFc:wmGC89zpEosfUfR3Hb2Qz3Xk9kR1Mfth","tlshash":"1fe3c54523d1213e8547f2629d7fcc46b33a8d68a385c85e790c94fc68189748bbeebd","size":144259,"data":"","first_seen":"2023-03-10T21:06:35Z","last_seen":"2026-07-26T06:29:09.059385Z","times_seen":1501,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/form-validator.min.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"c4daf2755cb5c35eb40079a0457af6af","sha1":"98813bbfbc7a3b53b68457778cbf073281af1ecb","sha256":"5932ef8c9c2d361a85d8834d47f508dbd305fda081fb646c18f7fbe76839080a","sha512":"428ab339eaee7b3da2ee135ae6e9a99dd7626693027f1eb33a4239486475dcda6bd40f2dfa40fed5d46728813354f874feb0572f6806ea51c523ef6640825051","ssdeep":"96:HaMWGbU563CvldugvwYdfWA3oTa9+xcuS+5ijkunc9s5BeK7p8vmiIKpiyW:HaMW+U563CvzugvXdfZUopjkunosfR+W","tlshash":"c9c13449366321921f9234f5419b828b72b97b38c50a409435fa84f1aaf8fc167f7b39","size":6063,"data":"","first_seen":"2023-03-09T06:26:16Z","last_seen":"2026-07-26T06:29:09.070751Z","times_seen":1531,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/jquery.min.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"0732e3eabbf8aa7ce7f69eedbd07dfdd","sha1":"4cd5ddc413b3024d7b56331c0d0d0b2bd933f27f","sha256":"ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b","sha512":"41d24c426abcf913be59917591d906318a547661280036b098a2b1b948bcf9ff14f268b140db10956730d64a857a61b81034d888ed7f857419dee6b8d327447c","ssdeep":"1536:ejExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1vE:eIh8GgP3hujzwbhd3XvSiDQ47GKq","tlshash":"e19309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","size":89503,"data":"","first_seen":"2023-03-07T01:10:32Z","last_seen":"2026-07-26T07:38:01.582346Z","times_seen":21311,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/owl.carousel.min.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"47c357c05cb99cedbac2874840319818","sha1":"d8b05365de4b760618328fdeef7672e8374978e4","sha256":"4e0781bdd2cbb5db04da3b5e059eeca34e325fabb893bee7457b5babf5b7c029","sha512":"960b76113c78220acc1c87e437c6698fbf1066b8cf7b15a6d4d33f31ab69d8e16bd9823c07ce1897db4d0bdfe08b39e5c7085b79a7a8ef80760e87d9aa789e2e","ssdeep":"768:RCI7dmuMFAAJG4dlQKNORpnXGAtep2lcwJeL+wr2RSNc7UuHjRUQuFBt33:AITMFC4dbMVRSNcgRDV","tlshash":"39137346b3202d2a869b61a0663f160bb23a241ce414547d7d79e6de6d7dc8c213ffbc","size":44348,"data":"","first_seen":"2023-03-07T01:06:30Z","last_seen":"2026-07-26T06:29:09.074628Z","times_seen":13472,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.no.Jvw2x7oPD4E.O/am=AAAQ/d=1/exm=el_conf/ed=1/rs=AN8SPfoNN7znqzt0dNyV59XSlfMCCgAClQ/m=el_main","fqdn":"translate.googleapis.com","domain":"translate.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.138","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"fa91d84d7ad500006b0663ec17f535e8","sha1":"84d84528ae65cafb304ad77bbab92d72ed0a4afd","sha256":"28e9904fc92408ba2affd0eaf173aaa62d4c4e53840202c108d82776bb127fde","sha512":"6a5604ea3c8bb34e37f8f6c57c9b4d766fdb5fbfffdc44b2a7e379ece36ca8287e52182e9728c3cf5b543f2ced6a1f16550fe33dbd945abeddd5d24a93d8f5f8","ssdeep":"3072:AhdxJmQS0zR+UXm8WRj/kpW6m7CCV7MjyxhJTTDu2MOHceWumXtHNzRfQExm:xYHb12xHcdHjzR2","tlshash":"a174dacab266b8939262f8a190bf004bb93ddd57b4484c6cb149d8ee5db08094177f7f","size":369951,"data":"","first_seen":"2026-01-20T20:12:22.451314Z","last_seen":"2026-07-08T19:52:58.548678Z","times_seen":1325,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"fb417d156519176b05410d65b27e0e06","sha1":"6e99d61a17654ca85bbd940108bddea93b283f5d","sha256":"c4769d1847e5f79a5d38f336b5f6cf94e9ee526b32417ec989b94fa366848c3b","sha512":"19ac2005dc0febd5d09ead6752e8bc84903a3a6df683c9dceba6521efda50245c181debeff4cea4a87ed7d46d174c114381c5938ccff60d51a3f3c72fe567311","ssdeep":"","tlshash":"115151a2605ca01b4503c5d0f8a23eeef4de0058c37169d07e1c29efdadac7704a716d","size":3011,"data":"","first_seen":"2025-12-11T22:16:04.368455Z","last_seen":"2026-02-02T19:35:57.84792Z","times_seen":2384,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"53687bc2a4622779474a927b5f55906e","sha1":"ed260d33e0f3c829942586cbe8c10ae6b8e74c3a","sha256":"361dfcc1f37254ea81280ff38b839508bec7bd4b4ad69c416eba287d0823618c","sha512":"742d95aced8170b2d1a488c454bb73f7c39ab54d29ab4dc8fb9fb4319b6c525de6a8ae99152159f695a70fe68cf474092eb7d41aa0e05f9e1e334b6918d9e92d","ssdeep":"","tlshash":"9bf0dcb30138b929c2828620e6c5a92de253db0445686caa336810b5f1c865e80efeac","size":470,"data":"","first_seen":"2025-12-11T23:03:44.314301Z","last_seen":"2026-02-02T19:35:57.846941Z","times_seen":848,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"6f80175508f99e8ec5ff57903d819bd7","sha1":"aeaa31459f526ddba433109087b18ba893824498","sha256":"b67e0756c8deeb68fb799f546ea59c83a7aa826a4c5ee04f3ec885bfd48327d5","sha512":"58f2a4d14722a9aac88367592c0bcbe267425a8ff280a2ca983e00ad20f6112165dd42ca35f2fcaeb38799a77fc6bfdbe5c1f919deeb08a19e616782e74dfd6f","ssdeep":"","tlshash":"65f0d4730138b915c2428620e6c5592de143cb0545585ca5335810b5f1c465d80dfeac","size":470,"data":"","first_seen":"2025-12-11T23:56:56.649504Z","last_seen":"2026-02-02T19:35:57.847436Z","times_seen":1025,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/partner/partner-1.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.889Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/partner/partner-1.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4435\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4435,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 130 x 35, 8-bit/color RGBA, non-interlaced","md5":"a0870e62943816aa1e7f2e60dce300c6","sha1":"2eb84c3e61fe5487c4f6e7e440a7e187866ca3d6","sha256":"6adcebaadd6ddd2bf42738c5db2b218c03dfe964bc1e5cb7c49d64fab90401d0","sha512":"02028698c0accc01ed05d12f60151eaf42fb25cde450cfb77443e0206b43381fceeec91e296c9dfc69115448c755a04c628137da4c6e1540ffb0838e3a87af8c","ssdeep":"96:+PrlHu+NacmxNKnUj70me81PcLSehjedNiBd/tSaXmg86lVA4xAN:0ZO+oji81PcLXjedNiB1bXt86rAN","tlshash":"c9919fe373a5319758c101634cd68eadc21b342f401dd4262a37fa7b5be5e290956af3","first_seen":"2023-11-12T08:26:57Z","last_seen":"2026-07-26T06:29:09.043875Z","times_seen":1313,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":131,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/why-choose-us/wh-img-4.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.900Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/why-choose-us/wh-img-4.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 76566\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":76566,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 350x330, components 3","md5":"ad20b9108d7c8c4ed34ba2566f113085","sha1":"3f90f5b5d8148b0c0e9f1713aeb2cade62fa632a","sha256":"6bdfde425c88941e7ab7768dcf616bcf59bc90d1177dcbcf11a2edb3d1052e38","sha512":"addd313edb714f7021ff17b80b0c37436eb422d51de667d0e329c7cd43a7dbd4ba88ebea97d91e87a57a87effda3e04e942ed635aa2373e847184f8f9f1cafdf","ssdeep":"1536:IMZBuqtQoqyjU8PlyECB88eU5jCtEL80nfAICK:ph39yt8S5AELXYIn","tlshash":"f47302ad9a036e06efb0afa1a55727fd95cf7b9c408374238181f63177548e018b72ad","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.03723Z","times_seen":1341,"resource_available":false,"data":null}},"time_used":149,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/flag/uk.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.914Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/flag/uk.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 2254\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2254,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced","md5":"1bd9dc32aa8ede4f19cd64e835d80597","sha1":"2d0586473fae3a4e3ada5c9b22dac6774c62efff","sha256":"1a81d14aa39b355e2fdb76619ae06df4de572f55904cd63b584546af42fd025c","sha512":"034f69c608575c364eec64ff64c2440c2125526ede4dfeec140eaaddc9253b04c03681cfb62435b1bf4cd027a9886305913fca97c54d85872269a59f087aed6f","ssdeep":"","tlshash":"d14129f1310cdb68c89686ef50e010c1a9e6aa4709080357aa3fa492a638872905b99e","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.083158Z","times_seen":1347,"resource_available":false,"data":null}},"time_used":150,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"translate.googleapis.com/translate_static/img/loading.gif","fqdn":"translate.googleapis.com","domain":"translate.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.138","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:51.312Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:24 GMT","end":"Mon, 23 Mar 2026 19:52:23 GMT"},"fingerprint":{"sha1":"43:39:AF:0A:74:F9:2F:1B:C0:1E:4E:89:21:30:C2:28:EC:9F:6C:67","sha256":"EA:F1:0E:C7:36:18:F3:9D:D1:D5:34:23:44:7D:6F:9D:2F:61:C7:81:09:9E:E9:C8:02:C8:F2:2C:0A:83:B3:A5"}}},"request":{"raw":"GET /translate_static/img/loading.gif HTTP/1.1\r\nHost: translate.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"static-on-bigtable\"\r\nreport-to: {\"group\":\"static-on-bigtable\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/static-on-bigtable\"}]}\r\ncontent-length: 702\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 23 Jan 2026 13:19:39 GMT\r\nexpires: Sat, 23 Jan 2027 13:19:39 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 03 Oct 2019 10:15:00 GMT\r\ncontent-type: image/gif\r\nage: 250812\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":702,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 16 x 16","md5":"eefaa072b284a305c12c06608333abc2","sha1":"58272721ccc1efda26eaa22354022c7c793edbb6","sha256":"fb6b7bcc1ab09f27db17bcbdf5239ce1d52af34f1fc5125b3fc8528a07848d21","sha512":"c5ccfdcd9ce76de85f043a1733c9f0b620e15babbaf2a5639684c7b2bb8e5a66473c9a83f14cb48d9cb6c6a1c6b36f2c5a28e25abaf131fb85ec5eedecbae4ac","ssdeep":"","tlshash":"5d01dd13f3d50473f66d0075a20cc57f010635daaadad7089a48117cfe1983c5239b82","first_seen":"2023-04-05T11:18:23Z","last_seen":"2026-07-26T06:37:18.711407Z","times_seen":16427,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.Qrtd5lGlzn4.L.F4.O/am=AAQD/d=0/rs=AN8SPfo9mDPo5pOm0HC4yPcwcdDdHSiNXw/m=el_main_css","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.708Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:29 GMT","end":"Mon, 23 Mar 2026 19:52:28 GMT"},"fingerprint":{"sha1":"D2:3B:6C:71:A7:BD:CB:B5:56:D1:90:EE:91:17:19:0F:24:02:E5:93","sha256":"DE:C3:87:EA:0D:EF:DF:B6:5C:9C:CE:F8:48:EB:2C:CE:06:FC:22:FD:3A:57:71:FF:23:81:1F:16:8F:67:66:B6"}}},"request":{"raw":"GET /_/translate_http/_/ss/k=translate_http.tr.Qrtd5lGlzn4.L.F4.O/am=AAQD/d=0/rs=AN8SPfo9mDPo5pOm0HC4yPcwcdDdHSiNXw/m=el_main_css HTTP/1.1\r\nHost: www.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"rosetta\"\r\nreport-to: {\"group\":\"rosetta\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/rosetta\"}]}\r\ncontent-length: 3969\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 20 Jan 2026 10:14:33 GMT\r\nexpires: Wed, 20 Jan 2027 10:14:33 GMT\r\ncache-control: public, max-age=31536000\r\nage: 521117\r\nlast-modified: Wed, 15 Oct 2025 01:09:54 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":20298,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (20298), with no line terminators","md5":"183cb263396f0b39789db1ae3f1e1b20","sha1":"502fcf18fa8d865213e282824ab2dfaadb9b8beb","sha256":"6a91c12a6fd1664f4d594040374fda61fe5b02fd3aee5f0c877ccbfc49488ec5","sha512":"ef280b60fa9f4bcb446d952f59a9b89442b6da6737bddc20a8fb38fcf0b4083170c09c008d7d221cf205084c8342da1f995bdd99ce907d70e8e14fc62d827acf","ssdeep":"192:nvqx/EhNINclXsfg0S0Q8CqA3ukLzSJFzvQVMZnUIfIxIRhpTpeuHjPtcmx4v78l:gM78Sr3fWJFzouRUqWQhpTpdHjPtc5G","tlshash":"bf92972047aed01967efa82364d36dff71d444db90523eeaaf5a7352cd821f231ea214","first_seen":"2025-06-11T00:07:11.687997Z","last_seen":"2026-07-08T04:13:28.550133Z","times_seen":37899,"resource_available":false,"data":null}},"time_used":339,"timings":{"blocked":154,"dns":37,"connect":28,"send":0,"wait":29,"receive":1,"ssl":87},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.Qrtd5lGlzn4.L.F4.O/am=AAQD/d=0/rs=AN8SPfo9mDPo5pOm0HC4yPcwcdDdHSiNXw/m=el_main_css","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:51.280Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:29 GMT","end":"Mon, 23 Mar 2026 19:52:28 GMT"},"fingerprint":{"sha1":"D2:3B:6C:71:A7:BD:CB:B5:56:D1:90:EE:91:17:19:0F:24:02:E5:93","sha256":"DE:C3:87:EA:0D:EF:DF:B6:5C:9C:CE:F8:48:EB:2C:CE:06:FC:22:FD:3A:57:71:FF:23:81:1F:16:8F:67:66:B6"}}},"request":{"raw":"GET /_/translate_http/_/ss/k=translate_http.tr.Qrtd5lGlzn4.L.F4.O/am=AAQD/d=0/rs=AN8SPfo9mDPo5pOm0HC4yPcwcdDdHSiNXw/m=el_main_css HTTP/1.1\r\nHost: www.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"rosetta\"\r\nreport-to: {\"group\":\"rosetta\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/rosetta\"}]}\r\ncontent-length: 3969\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 20 Jan 2026 10:14:33 GMT\r\nexpires: Wed, 20 Jan 2027 10:14:33 GMT\r\ncache-control: public, max-age=31536000\r\nage: 521118\r\nlast-modified: Wed, 15 Oct 2025 01:09:54 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":20298,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (20298), with no line terminators","md5":"183cb263396f0b39789db1ae3f1e1b20","sha1":"502fcf18fa8d865213e282824ab2dfaadb9b8beb","sha256":"6a91c12a6fd1664f4d594040374fda61fe5b02fd3aee5f0c877ccbfc49488ec5","sha512":"ef280b60fa9f4bcb446d952f59a9b89442b6da6737bddc20a8fb38fcf0b4083170c09c008d7d221cf205084c8342da1f995bdd99ce907d70e8e14fc62d827acf","ssdeep":"192:nvqx/EhNINclXsfg0S0Q8CqA3ukLzSJFzvQVMZnUIfIxIRhpTpeuHjPtcmx4v78l:gM78Sr3fWJFzouRUqWQhpTpdHjPtc5G","tlshash":"bf92972047aed01967efa82364d36dff71d444db90523eeaaf5a7352cd821f231ea214","first_seen":"2025-06-11T00:07:11.687997Z","last_seen":"2026-07-08T04:13:28.550133Z","times_seen":37899,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/css/odometer.min.css","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.867Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/css/odometer.min.css HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 384\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3123,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (3123), with no line terminators","md5":"6c6b4fd147a0f12f7702bfc0533b1d61","sha1":"ec5d35465e472d207dd16056b477ed5a643119d9","sha256":"de4852787adeccdbf98fbd828daa10e3ff7733dbecd8a94ae9f297e5f907049b","sha512":"30a2e4e97a9763cc8eb7e923a45e1c3e8b676308ab213a2d528d60ec3f974ee46cae763882ad032d37ef132bddd14a094c21d1888a5b87f4315ec2a59d02ce03","ssdeep":"","tlshash":"eb51e2154f91136863367506bac81b60befce9015123e98e731da54bcf43db9e398b0b","first_seen":"2023-04-07T13:32:55Z","last_seen":"2026-07-26T06:29:09.06974Z","times_seen":1504,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/css/style.css","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.875Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/css/style.css HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 13192\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":99243,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"231181ef0e78afe4c8c369f0b0cb8066","sha1":"3c14c3667faabea86bd4bd4f138100718a8f9c8f","sha256":"a7209c2137b1636de472b042fe4753d31967aff75a81c2869e9d3763bf165e5e","sha512":"1e54b7d227773bacf1bfd3e1f23b5b7216e584a17943b3a559fbd7fc265010fc651523ea3cb1ee9003c6a12a7d5681b1b461f539d16bebfe152aa48e07f5a4da","ssdeep":"3072:+gQgrtgMg7/TXecD1thqi9B1Gr8JZV+UhM3HFCwEdXN1yiZIwfdxgH:+gQgJgMg7/TXecD1thqi9B1Gr8JZV+US","tlshash":"2da3a9619246232ea127c61192cc66d43e38c563e72707feb6163716c7cb7e7226bf09","first_seen":"2023-11-12T08:26:56Z","last_seen":"2026-07-26T06:29:09.081072Z","times_seen":1102,"resource_available":false,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"translate.googleapis.com/translate_static/img/te_bk.gif","fqdn":"translate.googleapis.com","domain":"translate.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.138","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:51.659Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:24 GMT","end":"Mon, 23 Mar 2026 19:52:23 GMT"},"fingerprint":{"sha1":"43:39:AF:0A:74:F9:2F:1B:C0:1E:4E:89:21:30:C2:28:EC:9F:6C:67","sha256":"EA:F1:0E:C7:36:18:F3:9D:D1:D5:34:23:44:7D:6F:9D:2F:61:C7:81:09:9E:E9:C8:02:C8:F2:2C:0A:83:B3:A5"}}},"request":{"raw":"GET /translate_static/img/te_bk.gif HTTP/1.1\r\nHost: translate.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"static-on-bigtable\"\r\nreport-to: {\"group\":\"static-on-bigtable\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/static-on-bigtable\"}]}\r\ncontent-length: 848\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 23 Jan 2026 13:18:56 GMT\r\nexpires: Sat, 23 Jan 2027 13:18:56 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Sun, 25 Jun 2023 02:58:00 GMT\r\ncontent-type: image/gif\r\nage: 250855\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":848,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 59","md5":"daf9b48977041ac85a62dc9b7c16b38d","sha1":"049dcb061470572d06fd83b287ebd1d96e6bb870","sha256":"cb1fd0e051209c32622e91cdeda967e50d80a184b185ac6a656a807986e8eb75","sha512":"99f5f27990b6b5559c751a92c04037f5d42e848a966893484af66d3f66828c29a2dddc8788d7dd4cd835e8ab6d834e74fb3eaa4e2cd72d55b2813d7aab990af2","ssdeep":"","tlshash":"1c018c0cc8700a19e3422fb0ca5b6e0429675b465d88b20fb6aa22c27d04ba48049b1c","first_seen":"2023-04-05T23:29:53Z","last_seen":"2026-07-26T06:37:18.704606Z","times_seen":8836,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/partner/partner-3.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.891Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/partner/partner-3.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1737\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1737,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 130 x 35, 8-bit gray+alpha, non-interlaced","md5":"c8709f528bdf5908fa48eb0c8a96f855","sha1":"ac6bdab15e367ed6a1099fb91a8e71d3e80ec2ed","sha256":"821314c8b7cdbd225c05422daf867d1311816503399937c799e499ce9eb67918","sha512":"825c50712378108e37a0dd914d355384a757ab8e7444968441185da3e5cd6e01af5c3beea9a5166f89a323841ba0ef35b69c9b6a90445a5d83c82b724174a397","ssdeep":"","tlshash":"d3312b76db91fa2dc0313a32d418e35d6720bb8b945bcd223044bc54f1593b4bd23210","first_seen":"2023-11-12T08:26:57Z","last_seen":"2026-07-26T06:29:09.033456Z","times_seen":1312,"resource_available":false,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Raleway:wght@200;300;400;500;600;700;800\u0026amp;family=Roboto:wght@300;400;500;700;900\u0026amp;display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.239Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:24 GMT","end":"Mon, 23 Mar 2026 19:52:23 GMT"},"fingerprint":{"sha1":"43:39:AF:0A:74:F9:2F:1B:C0:1E:4E:89:21:30:C2:28:EC:9F:6C:67","sha256":"EA:F1:0E:C7:36:18:F3:9D:D1:D5:34:23:44:7D:6F:9D:2F:61:C7:81:09:9E:E9:C8:02:C8:F2:2C:0A:83:B3:A5"}}},"request":{"raw":"GET /css2?family=Raleway:wght@200;300;400;500;600;700;800\u0026amp;family=Roboto:wght@300;400;500;700;900\u0026amp;display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Mon, 26 Jan 2026 10:59:50 GMT\r\ndate: Mon, 26 Jan 2026 10:59:50 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12089,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"639340ecbe89bfa40436d07e95d5d5c0","sha1":"1fcee10dacb1971ee08f65e69f1a0a15e7c8ea32","sha256":"48b7b8dc47ec45da9abacf0728f246ec8715f4689bd4caae4c2a2555077e1f14","sha512":"7eee30b686c61f845fd5dfcf0bd3ba751062db920e776d3d7e8fcc3ba50e3dbc5a19acc6e3ce36569c0633e9d82b25574bb41315585697c36e0ec7b2487ba1e3","ssdeep":"192:MicTxHyDi1iHT+H1Dl0iaTzH0Dkfi9ToHfDPGi4TtHGD25iDTKH5DpYimTvHYDIp:x+NMzwNYr2tWXCRg3ExsP9","tlshash":"5d42ada10917d404eb476dc663ce3e36ee8e62057047953a9bfd58bcbcaad3613a070d","first_seen":"2025-09-14T16:10:41.877473Z","last_seen":"2026-07-26T06:29:09.036513Z","times_seen":1391,"resource_available":false,"data":null}},"time_used":274,"timings":{"blocked":122,"dns":1,"connect":7,"send":0,"wait":19,"receive":0,"ssl":123},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/fonts/remixicondf6ddf6d.woff2?t=1590207869815","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.460Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/fonts/remixicondf6ddf6d.woff2?t=1590207869815 HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/temp/custom/assets/css/remixicon.css\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:50 GMT\r\ncontent-type: font/woff2\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 125268\r\ndate: Mon, 26 Jan 2026 10:59:50 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":125268,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 125268, version 1.0","md5":"9915fef980fa539085da55b84dfde760","sha1":"4d375abf43ed18aa54264c1b59714b0a59c593a4","sha256":"e61f0d10c8cac8cd0ecb36790d6cce883380c0b185ff3c9bf849ed336ba8285c","sha512":"1e4c9a5e0f5150fe33870544c7d70a73724096e60ee10e0ade4def46f31647664afe361292c7ffb39a2edda98cab06bab206f64feb7f610ab137d17fc789a3b1","ssdeep":"3072:5vCveG1NooSPyIFS5WDTVKAQI+UHmfGsrKwfGXoiEw:tq5eTFa47QIVHmusrKWGoix","tlshash":"bcc312b6e11a945cfc80e9a278dc932d4d60145e4f80b7c7ce1912ac433ecdb4bec5a9","first_seen":"2023-04-12T01:04:15Z","last_seen":"2026-07-26T06:29:09.083861Z","times_seen":3982,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.no.Jvw2x7oPD4E.O/am=AAAQ/d=1/exm=el_conf/ed=1/rs=AN8SPfoNN7znqzt0dNyV59XSlfMCCgAClQ/m=el_main","fqdn":"translate.googleapis.com","domain":"translate.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.138","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.828Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:24 GMT","end":"Mon, 23 Mar 2026 19:52:23 GMT"},"fingerprint":{"sha1":"43:39:AF:0A:74:F9:2F:1B:C0:1E:4E:89:21:30:C2:28:EC:9F:6C:67","sha256":"EA:F1:0E:C7:36:18:F3:9D:D1:D5:34:23:44:7D:6F:9D:2F:61:C7:81:09:9E:E9:C8:02:C8:F2:2C:0A:83:B3:A5"}}},"request":{"raw":"GET /_/translate_http/_/js/k=translate_http.tr.no.Jvw2x7oPD4E.O/am=AAAQ/d=1/exm=el_conf/ed=1/rs=AN8SPfoNN7znqzt0dNyV59XSlfMCCgAClQ/m=el_main HTTP/1.1\r\nHost: translate.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"rosetta\"\r\nreport-to: {\"group\":\"rosetta\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/rosetta\"}]}\r\ncontent-length: 105101\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 23 Jan 2026 13:26:09 GMT\r\nexpires: Sat, 23 Jan 2027 13:26:09 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 19 Jan 2026 18:09:01 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nage: 250421\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":369951,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (2481)","md5":"fa91d84d7ad500006b0663ec17f535e8","sha1":"84d84528ae65cafb304ad77bbab92d72ed0a4afd","sha256":"28e9904fc92408ba2affd0eaf173aaa62d4c4e53840202c108d82776bb127fde","sha512":"6a5604ea3c8bb34e37f8f6c57c9b4d766fdb5fbfffdc44b2a7e379ece36ca8287e52182e9728c3cf5b543f2ced6a1f16550fe33dbd945abeddd5d24a93d8f5f8","ssdeep":"3072:AhdxJmQS0zR+UXm8WRj/kpW6m7CCV7MjyxhJTTDu2MOHceWumXtHNzRfQExm:xYHb12xHcdHjzR2","tlshash":"a174dacab266b8939262f8a190bf004bb93ddd57b4484c6cb149d8ee5db08094177f7f","first_seen":"2026-01-20T20:12:22.451314Z","last_seen":"2026-07-08T19:52:58.548678Z","times_seen":1325,"resource_available":true,"data":null}},"time_used":272,"timings":{"blocked":61,"dns":75,"connect":22,"send":0,"wait":23,"receive":51,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"translate.googleapis.com/element/log?format=json\u0026hasfast=true\u0026authuser=0","fqdn":"translate.googleapis.com","domain":"translate.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.138","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://northwesternunion.com/","date":"2026-01-26T11:00:01.077Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:24 GMT","end":"Mon, 23 Mar 2026 19:52:23 GMT"},"fingerprint":{"sha1":"43:39:AF:0A:74:F9:2F:1B:C0:1E:4E:89:21:30:C2:28:EC:9F:6C:67","sha256":"EA:F1:0E:C7:36:18:F3:9D:D1:D5:34:23:44:7D:6F:9D:2F:61:C7:81:09:9E:E9:C8:02:C8:F2:2C:0A:83:B3:A5"}}},"request":{"raw":"OPTIONS /element/log?format=json\u0026hasfast=true\u0026authuser=0 HTTP/1.1\r\nHost: translate.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: x-goog-authuser\r\nReferer: https://northwesternunion.com/\r\nOrigin: https://northwesternunion.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 200 OK\r\naccess-control-allow-origin: https://northwesternunion.com\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser\r\ncontent-type: text/plain; charset=UTF-8\r\ndate: Mon, 26 Jan 2026 11:00:01 GMT\r\nserver: Playlog\r\ncontent-length: 0\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T07:24:10.984473Z","times_seen":17541736,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":18,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/flag/usa.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.905Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/flag/usa.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1123\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1123,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit colormap, non-interlaced","md5":"71f2b9f8290de4e2ef115bbd7e88e606","sha1":"772dd8595caf015645f933ee938df8602afce809","sha256":"2c842607ca094c8e0e7e92951eb9369860ad967fc8a52e664098efb53b78665c","sha512":"8f7621171112c3302a8b6f433b176092b0f45d2f6108875619321acfa6dbc5485fd8f676e3adbc65455410dec1b60afb2ac83699860ca4059a0a451a86f8d805","ssdeep":"","tlshash":"6d21b96ef7e018c1c8db60074ef4357258257c9e8fe0f874b562940fd8b51092a46733","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.040931Z","times_seen":1348,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_68x28dp.png","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:51.310Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:29 GMT","end":"Mon, 23 Mar 2026 19:52:28 GMT"},"fingerprint":{"sha1":"D2:3B:6C:71:A7:BD:CB:B5:56:D1:90:EE:91:17:19:0F:24:02:E5:93","sha256":"DE:C3:87:EA:0D:EF:DF:B6:5C:9C:CE:F8:48:EB:2C:CE:06:FC:22:FD:3A:57:71:FF:23:81:1F:16:8F:67:66:B6"}}},"request":{"raw":"GET /images/branding/googlelogo/1x/googlelogo_color_68x28dp.png HTTP/1.1\r\nHost: www.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"static-on-bigtable\"\r\nreport-to: {\"group\":\"static-on-bigtable\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/static-on-bigtable\"}]}\r\ncontent-length: 1597\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 26 Jan 2026 10:00:37 GMT\r\nexpires: Tue, 26 Jan 2027 10:00:37 GMT\r\ncache-control: public, max-age=31536000\r\nage: 3554\r\nlast-modified: Fri, 30 Jun 2023 18:58:00 GMT\r\ncontent-type: image/png\r\nvary: Origin\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1597,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 68 x 28, 8-bit/color RGBA, non-interlaced","md5":"c4a931d597decd2553aac6634b766cf2","sha1":"6ec84fb4a2745b4b71520241be77db1fd1013830","sha256":"f56402b127698db4b4dc611a97a6f081d04c4691c60522c5912d189e37c94a9e","sha512":"4932e0f7f38085a7c52539bdd5c7f470740e560a4471bea30d12ef9e3efe77f6bbfac28d26c62a245c43d98ebf74c824b2b414843080a27edf1563a5f874ac84","ssdeep":"","tlshash":"7c310afff39e8cec419e764069ba5965a362cd68233e928f14499592e4d007710f5f41","first_seen":"2023-04-05T08:27:37Z","last_seen":"2026-07-26T06:37:18.703862Z","times_seen":16794,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/down-arrow.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:51.620Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/down-arrow.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/temp/custom/assets/css/style.css\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 438\r\ndate: Mon, 26 Jan 2026 10:59:51 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":438,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit gray+alpha, non-interlaced","md5":"6f1f1acf5c62fcda73ee05662c8182ae","sha1":"e09fc52fa587eb882b2f31f4e6380c820e5078b1","sha256":"777bfb6de1e8019c69bfcf4a6a4113b04ac9ff635ab57457686820830b68a6e5","sha512":"84d1fe9adb2b18c8f3aa3154c6fb59e285c8a55b08d24b5d99abf8d8f904d6cb2046dcbdc3cb6114baa5ec21f8bef1b149a1d3f3d2baf97ea2b71593e2343a71","ssdeep":"","tlshash":"fef023f7535250a8dfb14570696d00f4dc37202d9d02910646094eef65d1090c8c7802","first_seen":"2025-04-23T10:50:27.724108Z","last_seen":"2026-07-26T06:28:56.01034Z","times_seen":542,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/chart-img/chart-2.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.911Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/chart-img/chart-2.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 534\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":534,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 68 x 28, 8-bit colormap, non-interlaced","md5":"c9eb18efeaa14310c0b3db2bc9f93a27","sha1":"c48275e79ca07a678467c7ede198b3ad2061f39e","sha256":"5f4957ffe8a2e4b25b354480b2ef2e44a663748a2bbdee7e172a62f16cfe58ea","sha512":"4281040fc9d75e2101d34f28221e97676f7e76a49355c81337dbb4a8f7704d8928c22aabca3f79db08544d721cf265817388a72a018b58e89bfb5327010d088a","ssdeep":"","tlshash":"8df005e2d5984f8c556c845113734ee0663c079b674071459d33d0a22ffd6acb2ebbc0","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.0466Z","times_seen":1284,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/blog/blog-2.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.940Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/blog/blog-2.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 172759\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":172759,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 565x400, components 3","md5":"6e8d6d81af41649e282d864bbd6110cc","sha1":"f2cf79b706b7a7ad5c4b3a1eb0188ae4ee8f0845","sha256":"db0b6f3926112907cc9316670c759eb24793d3da4271507cac4198c3b38fb8d5","sha512":"177e11ead66cb9967f35c2eae459de97b7199f046ef62313000a99ad3b5fe598f49fb3a43823e55ba003bb648cb84378e89b8807b354d15e706afe743c899d1a","ssdeep":"3072:ZgbtQno7ljRcK0uK+CevaBTHy0y6ayjQs8wlX+wfEgOqmLLsERVoh0l0B5Y:Z6yo7ljli8ag6dBX+wfz4LwEEh0yB5Y","tlshash":"adf3123c07c34500179d25a32db31792639c9111e94ad8af52d7f6a29ecebdd83648be","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.066485Z","times_seen":1318,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.html","fqdn":"cdn-cgi","domain":"cdn-cgi","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.977Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /scripts/5c5dd728/cloudflare-static/email-decode.min.html HTTP/1.1\r\nHost: cdn-cgi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T07:24:10.984473Z","times_seen":17541736,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/raleway/v37/1Ptug8zYS_SKggPNyC0ITw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.454Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:23 GMT","end":"Mon, 23 Mar 2026 19:52:22 GMT"},"fingerprint":{"sha1":"5A:74:FC:38:D2:7B:9B:E5:E5:0D:67:25:F4:73:BC:BA:2E:12:A7:FD","sha256":"3B:19:CD:BE:44:E6:EE:DC:8D:33:2B:A2:1C:E4:13:F8:6F:7E:2E:52:5D:0E:75:F3:1A:ED:21:1B:7A:B7:2E:BA"}}},"request":{"raw":"GET /s/raleway/v37/1Ptug8zYS_SKggPNyC0ITw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://northwesternunion.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48264\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 23 Jan 2026 12:29:36 GMT\r\nexpires: Sat, 23 Jan 2027 12:29:36 GMT\r\ncache-control: public, max-age=31536000\r\nage: 253814\r\nlast-modified: Tue, 09 Sep 2025 19:08:31 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48264,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48264, version 1.0","md5":"e401cae7a12911a5c9752dc7a62f9dd7","sha1":"5685dd613a8a8211bf60b4b10753a47587bd0b60","sha256":"b1bef1f03a77a36fc257c5525e32a1dd621bb6f935b743a419da7ed0b18dc8f5","sha512":"dc8b6f28bc048efb508b482199c958ffaeddf15431aad34544f5b9972fd8c19e0315f74499d5549b30e15a03e41bfaf2a30613b6889b9a693a9c87c4e872e1f3","ssdeep":"768:AWHBpvVWVHIgyYwXiDAOa6GWeFGaCfLBc/qiufIdQRuEl4ofxl8VKme:AWbEIgmi8uAFCfS/OfUYuRExl8VFe","tlshash":"1123f2e56c6a826bd88c882945ee21c1f3d7f4927713d149e8fa5df8c432c05ed5066b","first_seen":"2025-05-29T19:02:42.430777Z","last_seen":"2026-07-26T06:30:21.494151Z","times_seen":61732,"resource_available":false,"data":null}},"time_used":232,"timings":{"blocked":90,"dns":1,"connect":21,"send":0,"wait":22,"receive":30,"ssl":66},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/hero/hero-shape-6.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.881Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/hero/hero-shape-6.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1934\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1934,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 65 x 97, 8-bit colormap, non-interlaced","md5":"f83b8c90bfd681efd73d4819b6d12b7a","sha1":"443a851b10b6d2b331b4fa05f6ec6bfcb8482d5b","sha256":"35f443944fc4ae8a47098e39823bc5d967f9d440dac39971d5b3f0858f185f8d","sha512":"2a13e0f0e85cdd5b8c14c84dce56950c6e3071b5a39fa380aca3aa8f509745f8f1cc23df22038338c29d523107135d3530db173fb08cbea9a7579b950fcdc3c5","ssdeep":"","tlshash":"d8413b62c4063c7bfa4468b5d612088fe4b9c62a079502353bec71e17b6606c993057c","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.079668Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/images/197582.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.929Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/images/197582.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 23698\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":23698,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"905fcb9b1a36f5f816201b4108a4681a","sha1":"1a5913195dbd63eee109041a53f4421e53a088fa","sha256":"6b3af5b3118aa1b73600bd038e97ccd56643d6c076ecda896512f87c3a46fe61","sha512":"15b7e358ec2dd5a3cf524a285529f4cae6cea292ee75126fcbecea154c2103f1677a21c1260f5d3bccbb23f6986d861c1f7fffad88d6289a0a7637eefcdd0b11","ssdeep":"384:F+uZBeEnw+Y9sziZDWm/SWHbE8qTsQpxSMtetCh3mldBEc+y6nR:F+uZnYUiZDWGSW7O/ttJ3md6R","tlshash":"c6b2e1ad42712d32195e5dc57a5fad404dc03dd178f4dce2234ba8887e02be0dc6dea5","first_seen":"2023-11-12T08:26:57Z","last_seen":"2026-07-26T06:29:09.095472Z","times_seen":1419,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/tweenmax.min.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.036Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/js/tweenmax.min.js HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 41298\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":144259,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (36174), with CRLF line terminators","md5":"3ebfc60317f7c7439949d5728c2e7905","sha1":"6bdc6e3e92cf447dc3922977d923b2901e36640d","sha256":"db1047e16f9ed072dbc343334fb2dde5f14c486676495bed4e592d75dc73522a","sha512":"dbf9d706a05c8b5215e73702744e075522cd0641e1a9a6566004866681eb6d3e55e5d8cf47829a2c6bb85f9a64d25555efe9b65c8c6614332177753583d142c7","ssdeep":"3072:wAcorGC89zpEosfUfR3Hb9jLYQz3Xk9kqJaR1MfgO4553Njx849GXIFsHtsznbFc:wmGC89zpEosfUfR3Hb2Qz3Xk9kR1Mfth","tlshash":"1fe3c54523d1213e8547f2629d7fcc46b33a8d68a385c85e790c94fc68189748bbeebd","first_seen":"2023-03-10T21:06:35Z","last_seen":"2026-07-26T06:29:09.059385Z","times_seen":1501,"resource_available":true,"data":null}},"time_used":144,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":95,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/form-validator.min.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/js/form-validator.min.js HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1913\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6063,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (5862), with CRLF line terminators","md5":"c4daf2755cb5c35eb40079a0457af6af","sha1":"98813bbfbc7a3b53b68457778cbf073281af1ecb","sha256":"5932ef8c9c2d361a85d8834d47f508dbd305fda081fb646c18f7fbe76839080a","sha512":"428ab339eaee7b3da2ee135ae6e9a99dd7626693027f1eb33a4239486475dcda6bd40f2dfa40fed5d46728813354f874feb0572f6806ea51c523ef6640825051","ssdeep":"96:HaMWGbU563CvldugvwYdfWA3oTa9+xcuS+5ijkunc9s5BeK7p8vmiIKpiyW:HaMW+U563CvzugvXdfZUopjkunosfR+W","tlshash":"c9c13449366321921f9234f5419b828b72b97b38c50a409435fa84f1aaf8fc167f7b39","first_seen":"2023-03-09T06:26:16Z","last_seen":"2026-07-26T06:29:09.070751Z","times_seen":1531,"resource_available":true,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/owl.carousel.min.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.002Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/js/owl.carousel.min.js HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 11143\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":44348,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (31997), with CRLF line terminators","md5":"47c357c05cb99cedbac2874840319818","sha1":"d8b05365de4b760618328fdeef7672e8374978e4","sha256":"4e0781bdd2cbb5db04da3b5e059eeca34e325fabb893bee7457b5babf5b7c029","sha512":"960b76113c78220acc1c87e437c6698fbf1066b8cf7b15a6d4d33f31ab69d8e16bd9823c07ce1897db4d0bdfe08b39e5c7085b79a7a8ef80760e87d9aa789e2e","ssdeep":"768:RCI7dmuMFAAJG4dlQKNORpnXGAtep2lcwJeL+wr2RSNc7UuHjRUQuFBt33:AITMFC4dbMVRSNcgRDV","tlshash":"39137346b3202d2a869b61a0663f160bb23a241ce414547d7d79e6de6d7dc8c213ffbc","first_seen":"2023-03-07T01:06:30Z","last_seen":"2026-07-26T06:29:09.074628Z","times_seen":13472,"resource_available":true,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":145,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/css/flaticon.css","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.856Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/css/flaticon.css HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1149\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5680,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (5680), with no line terminators","md5":"09bfb87f4fc89fa772195da8afa1489f","sha1":"88ee2649f1e1b1e8048a0f8fb8ee750a16f339ea","sha256":"53f7eaccc5cabff8999753b23d2e2aab91a4fa445707494f4ce0d0af103fa211","sha512":"37dba85918d11177c8c46601bcd6651181afdddf0659ca24bd31213d8482e647faf0a0b25a532b316ce4fd80c9474c3ea0ad575cc98f378d5cf13634f87a512c","ssdeep":"48:s8HaHKHAEGQ4GDb3aHF1bmZmr2mHkw+JbO+TnVBGa045LDyeXoiXA:pHaHKHAEGQtQb6cF+JbO+LzTXG","tlshash":"dcc10fa4e46a10c47732ce0bafe9b218e698b128cdc19d15f11f4e1cbdf1b554386eb9","first_seen":"2023-11-12T08:26:56Z","last_seen":"2026-07-26T06:29:09.063516Z","times_seen":1312,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/css/fancybox.css","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.870Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/css/fancybox.css HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 2931\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":13039,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (13039), with no line terminators","md5":"32ea6a4849f931f79f4ec5816923413f","sha1":"c9fa6fa910b8cd76cf14faf4ff98933c7bae6b45","sha256":"e2d2ac9b36a0e51b450d1f32059ba46fbadcc5ad9d3063abfb562ac714211af5","sha512":"bbcf2ce681b368745003b3e64a8aed9bed1cafb08bce2ddd375ee5e6fea16d68ce5bcb452bcd603a3e0937f41401660ec3703430ada8d2877eb894445c6964b3","ssdeep":"192:yJ6DcJ566s6kC/wEvH30trWc/p2/Pw8RvGgNmUKJwe:yJKQJl/wEvX4jx2/zvG1Nx","tlshash":"db4251336540312c407bcd22d7cfe948e13a9155aa2216fbea4cfd69cbc77e911d62c6","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.048128Z","times_seen":1463,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/css/dark-theme.css","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.878Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/css/dark-theme.css HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1686\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8642,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (8642), with no line terminators","md5":"2db98f202b2ea99a2c0e546c85d9899c","sha1":"71cb4231c618f94ef4fe9d1882f8a4e730f016f5","sha256":"04849ae2f5fa626f72455997b529e5612c6413077047c10486073461417b9a8a","sha512":"48a3e8bedc02c5523783f299230e749b7a6e080d8d5355f6b40b6e4f8ca9b477b41a8521014219d3cb50f88959c0e73910f5930822e7c9dfcf1a6d27d7eac207","ssdeep":"192:0KBCZ6B2nSPehnzhOe9mVxwVdU19HSkiwo7Ux+hvGb3lijIj3Yp2y3yZp1:0nSeyeY9khoEjIj3Yp932p1","tlshash":"9d02be20ed722e3a21138518f488bf981f7e31a0d6067b7df22b15e4de5a1de63b1b45","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.088917Z","times_seen":1357,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":78,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/aos.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.982Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/js/aos.js HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4224\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":14243,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (14243), with no line terminators","md5":"a01f9089e8301e9eacfb9d029dc0ca5c","sha1":"165152546121aaaf96c19418908cffe3630a2336","sha256":"4460f1596174d06cca957fdaca2c71e1a377cf1d6f07ee4c75ffb3bf3fc97a03","sha512":"a90277dcdf97d7decdc3ee3546ff80d537a779d7c70a44b6fdc0059df4c131d92af5336ba238b3f3e7c5dcd721c283616a1a54338203864479d47b120aeae80b","ssdeep":"384:3IkfNaayGbHbcggNFUWTgZeo1sa6XCZy54:4kfNaayGbHbfgNFUWgwAslXCZy54","tlshash":"5552e7dc3681f0a617a794f7826f600ff2f14834245e90a0d269c4e67db58ae8673f5e","first_seen":"2023-03-07T01:35:54Z","last_seen":"2026-07-26T06:29:09.081772Z","times_seen":11414,"resource_available":true,"data":null}},"time_used":147,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":92,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/testimonials/client-3.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.884Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/testimonials/client-3.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 38351\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":38351,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 200x200, components 3","md5":"0b0594273fe1b0c138afaec55d626365","sha1":"42fbe28cd4401ff7905592ef8aed7e257de18c41","sha256":"ae7da33946d2beb7729ca295821719219230adec8515594ddc697edb228df028","sha512":"f4af1f08a8c8337f2710e438a7c9dbf02486ab24f9ce916d4b21305bb1ab5c64a88562608bfc67880fc3ab870e591a3b5f5c7b021da4e228201f5459303e456d","ssdeep":"768:efjnuv39PX16ZmtIET7ST7XNzGU4jtku6pzL+iePBObysNY7z:QjK3lXamtHOoPt34iObysNYf","tlshash":"dc03f2a4bb4f1c2ae6535488548d87de950bff4c396f36812ce845636c1b3279c1d19f","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.09397Z","times_seen":1372,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":106,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-26T10:59:49.492Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: no-cache, private\r\nset-cookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; expires=Sun, 19-Apr-2026 18:59:49 GMT; Max-Age=7200000; path=/; samesite=lax; secure\nvereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D; expires=Sun, 19-Apr-2026 18:59:49 GMT; Max-Age=7200000; path=/; httponly; samesite=lax; secure\r\ncontent-length: 6939\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"GSAP","description":"GSAP is an animation library that allows you to create animations with JavaScript.","website":"https://greensock.com/gsap","common_platform_enumeration":"","icon":"TweenMax.png","categories":["JavaScript frameworks"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"OWL Carousel","description":"OWL Carousel is an enabled jQuery plugin that lets you create responsive carousel sliders.","website":"https://owlcarousel2.github.io/OwlCarousel2/","common_platform_enumeration":"","icon":"OWL Carousel.png","categories":["JavaScript libraries"]},{"name":"Popper","description":"Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.","website":"https://popper.js.org","common_platform_enumeration":"","icon":"Popper.svg","categories":["Miscellaneous"]},{"name":"jQuery:3.2.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Bootstrap:404.0.0","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Tidio","description":"Tidio is a customer communication product. It provides multi-channel support so users can communicate with customers on the go. Live chat, messenger, or email are all supported.","website":"https://www.tidio.com","common_platform_enumeration":"","icon":"Tidio.svg","categories":["Live chat"]}],"data":{"size":36806,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (335), with CRLF, LF line terminators","md5":"beb5d33fbdd38dd02f3108d43932b134","sha1":"8dc21781ca4d2dc213d7e233a4a15bc362f1f417","sha256":"5e02622bf9a6a84f0d3eba5b9e66b04b012d0f8295aa67ed002e8044f0de6b18","sha512":"30277a907adc5ab8666b08ffae5331097c21cd1c2be63407a25f7c83874ee565e350a2634d7ef3e7939abab531cb1b149ae917b5c3f1b57142fb0922a8df1ebf","ssdeep":"768:2SYrhXn+Z65KYJ8+BsQ52zmCxpd0F/4pbXq1NiE3exFD/m:5AXn+Z65FJ8SCxpd0F/4pbXq1NiE3exM","tlshash":"e2f22d2124f2113301a394d16a256f5bafe1e303ca5b4a187abd1feb6fc7d92cd17528","first_seen":"2026-01-26T10:39:00.011553Z","last_seen":"2026-01-26T11:00:36.969375Z","times_seen":3,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":52,"dns":2,"connect":24,"send":0,"wait":75,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/about/about-img-6.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.898Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/about/about-img-6.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 100901\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":100901,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 320x400, components 3","md5":"f7ba0df7243cef46807ff8d03bc34777","sha1":"0afd7d2058543a89f2f84742fad305ab8283f7aa","sha256":"0bbd00e0128ce44e69e51fa7167c7e68f73f6d08c6d27f2723c5a85379b8f7de","sha512":"318befb2561d1471fbf0f6d3766dd5f0d8bcf2ce051b479ce64712e92be2251e609434537067cae7bb6b5563df41cfe7a3ce6f39a8bae960283c351f1986dd3c","ssdeep":"1536:JTV9Ij1UhMHAHn2zOEJUmOkm/r2EP80x2Ad1e6SzavRvCpMoPBgFwJrEQxQ:Jx9I+hwAH2zPqfkUr2ELrejs4pr89","tlshash":"cda3124f8c73fc60e61fa612882ce1bc26b6860df862827c44d0d715f63b76b7976045","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.073669Z","times_seen":1337,"resource_available":false,"data":null}},"time_used":147,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap%404.0.0/dist/js/bootstrap.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.849Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/bootstrap%404.0.0/dist/js/bootstrap.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://northwesternunion.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 400 Bad Request\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=86400, s-maxage=86400\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/plain; charset=utf-8\r\netag: W/\"3e-rVTZaEP/IducDerMLIXX9cqTIf0\"\r\naccept-ranges: bytes\r\nage: 47294\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nx-served-by: cache-fra-eddf8230194-FRA, cache-hel1410023-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 62\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T07:24:10.984473Z","times_seen":17541736,"resource_available":true,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":1,"connect":15,"send":0,"wait":15,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/testimonials/client-1.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/testimonials/client-1.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 29011\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":29011,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 200x200, components 3","md5":"4658267f97ddc4e728a30e1b34f3dc91","sha1":"803b36fb2ad050ade535685b5f3ac92a32a87598","sha256":"6d8b362584cdc3dfc95309e4af19147517ae92c27d28e602c212ac92913e3f0c","sha512":"883a1f2574964f274f6f0daed68f7c8f8c9194a3a0f320f56629874800146c33941d683ce5216632651af18f7937452ec937b988d2142a2a96e686f7ccb01993","ssdeep":"768:2NeLTkSwjEri/BzR+qGPiOcSni777QMa3tAofJ3:SgoZEriBGPiOmwMa3yol","tlshash":"29d2f18841e749819021c3f2107af51d678a695c6d2b031b91d93c72ccafff64f5ea78","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.067682Z","times_seen":1387,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/why-choose-us/wh-img-6.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.903Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/why-choose-us/wh-img-6.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 180305\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":180305,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 350x692, components 3","md5":"5c9ea178a8573030d28ffb3525b2f3b1","sha1":"9ff7af508915c2488e5188bb3824f6c492232302","sha256":"866c823886969f332ee6ad51137f1daec2480cfa6fa78cdcbb411dc37be97499","sha512":"84d5e9ae8d06a1afc0cfa27b56d1ddbb9d8fe5dfcecbcd18a46e50a8041ca8c7ef875c84389a5f86f22efe4a61983dc2be5e65cf60e0c81f071b2aab7c723899","ssdeep":"3072:OpYQ94yA0CLKJ5Z36nneMWZNy8+ERR3RpS9d0DBD5VUe77AGI5:OpYQo0JZ3iGZNj3Rp4d0dDHXS","tlshash":"d40413ca08fd6bf4a6d80c235e29fb2457a66fba57098abd91c7f466c7d5000e097d0c","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.082467Z","times_seen":1310,"resource_available":false,"data":null}},"time_used":161,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":148,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/partner/partner-2.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.890Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/partner/partner-2.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4424\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4424,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 130 x 35, 8-bit/color RGBA, non-interlaced","md5":"bdc7140f040e5fe80b9cee96ca8e77f8","sha1":"92c693ed81445c35abbf7bcafd15ebdd18ddf4a1","sha256":"e782d18eb3e52bd22b5b7e81e9ef38cb890aee35f3826efe90e84db4977fe76f","sha512":"fc0a5c14d3d554fb3661d46aeaa3b5d73e25ba4890dfc5d0a19eb4554fa502d3b55da657f972d206bfeb729e278ccd6aebf8d5ec4471f2b4e0cd986e4be0f682","ssdeep":"96:58UgvPikQZz+WcvcsA6w2T1ZmfVdhgoLB3JVDH0aecj69mc:1oPkz+WsAAPmfb7B3JF0aecjQmc","tlshash":"2b917e6b23147b7d9dd972a48c953c2fece4bf2622ec47805c4b0235c3f951c4d62118","first_seen":"2023-11-12T08:26:57Z","last_seen":"2026-07-26T06:29:09.054225Z","times_seen":1318,"resource_available":false,"data":null}},"time_used":136,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":131,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/flag/eu.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.928Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/flag/eu.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 868\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":868,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit colormap, non-interlaced","md5":"b8bcad392a1d7f64622798d6e0059920","sha1":"b41ed94de447df832b59e53abe23fdd52e179523","sha256":"ce61c4677c93bfdd6c804e6100859ab906fe93c565cce3a368686b15c68d49a2","sha512":"f0da32809a628ed6b09c01d456b3b313600853a7641246a30079204fb0ca43c2d4610e0b2aa64fd4e472dc92c775f865d3316c982cc941850a46cb1f92e1a124","ssdeep":"","tlshash":"ec11561a5f64c6acd08806afa09438b4f47540461d257a17dc4e346499ffb6c6d36381","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.027268Z","times_seen":1349,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/partner/partner-4.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.893Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/partner/partner-4.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 3448\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3448,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 130 x 35, 8-bit/color RGBA, non-interlaced","md5":"c7b36c0c4560fdea98eab463db51a474","sha1":"00e01da4b9a08cf4f859f4ba3c54fe292be72388","sha256":"fce1540a6b8cf77da50e312a7d5eb2dde2176f7f1ff7fbbad1e5a4c30ef0cc44","sha512":"b5a856be934819a91c325f5b8a9430175136dba7cdc524706798dfc484bcba4209e442cf48f3290f043d9f88e0ee5cb153de19e98f9a2fc1ad6bd240b2921df7","ssdeep":"","tlshash":"7c618e9e580af69503a83390e9605dcd60169026b75936b5d30342effb6ca7350bd307","first_seen":"2023-11-12T08:26:57Z","last_seen":"2026-07-26T06:29:09.055802Z","times_seen":1317,"resource_available":false,"data":null}},"time_used":135,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":131,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/jquery.countdown.min.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.030Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/js/jquery.countdown.min.js HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 2238\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5360,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (4136), with CRLF line terminators","md5":"76a923d3d69255c45cd24bf9b100244f","sha1":"eb3c96f9901692f1a03500ea632963a16afdb985","sha256":"8f195573d6fa06641814b476fea2b92579c983cac46d683f356238207692c9f5","sha512":"b97bed03f0e8868df19d9e2437158b89f06a46827af8876f616c8f42786d145105964e8518d8bad9eece23cd9c7a4767f39861488c5410ab42ffc7e20cde44a4","ssdeep":"96:GBXpuplQHIwbeRFMSiM3jG6Ghdynv/2bBqz2eJxMxHxqxAxixw3xexIxrxAxW7qf:rQHnUpxGhdBqztJxMxHxqxAxixw3xexx","tlshash":"b9b1a5ceb3b213d508e553a201ae1116a27bf15be4d6001cb5fceac87a75c9d606fd78","first_seen":"2023-03-07T01:28:01Z","last_seen":"2026-07-26T06:29:09.032628Z","times_seen":10315,"resource_available":true,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/main.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.042Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/js/main.js HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1451\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5498,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (3752)","md5":"c36261f13ab72adcc6d121b42ecf7527","sha1":"c3797740ed1bcf47c268153320a1d04cec5d014c","sha256":"087aa918d5cd7d8340a2facc168e57245932b0a5f668f6249a45727b7868da1c","sha512":"a61e110a84815d8b4cb3bd2158daad9f9e12a20c95244c7d099b8f714efa5aa4ce48b72d699e4a08e6fdb7712bab17c7521586f52e18d683585df2f4c530c729","ssdeep":"48:YcKnGmRenN89Di9ooisW9ooiEM//PPBlLMeBlLqPBebfH0Yujmwm8Q+03iMbq1x5:YGOZ7W3vTLMyLqk9+0DeLfa+TBdD/","tlshash":"56b1864e712030ab94ef331598df6a44bf3b1910d700e999e2b641797d6890fbcb3a6d","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.049792Z","times_seen":1404,"resource_available":true,"data":null}},"time_used":144,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":144,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.Qrtd5lGlzn4.L.F4.O/am=AAQD/d=0/rs=AN8SPfo9mDPo5pOm0HC4yPcwcdDdHSiNXw/m=el_main_css","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:51.475Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:29 GMT","end":"Mon, 23 Mar 2026 19:52:28 GMT"},"fingerprint":{"sha1":"D2:3B:6C:71:A7:BD:CB:B5:56:D1:90:EE:91:17:19:0F:24:02:E5:93","sha256":"DE:C3:87:EA:0D:EF:DF:B6:5C:9C:CE:F8:48:EB:2C:CE:06:FC:22:FD:3A:57:71:FF:23:81:1F:16:8F:67:66:B6"}}},"request":{"raw":"GET /_/translate_http/_/ss/k=translate_http.tr.Qrtd5lGlzn4.L.F4.O/am=AAQD/d=0/rs=AN8SPfo9mDPo5pOm0HC4yPcwcdDdHSiNXw/m=el_main_css HTTP/1.1\r\nHost: www.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"rosetta\"\r\nreport-to: {\"group\":\"rosetta\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/rosetta\"}]}\r\ncontent-length: 3969\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 20 Jan 2026 10:14:33 GMT\r\nexpires: Wed, 20 Jan 2027 10:14:33 GMT\r\ncache-control: public, max-age=31536000\r\nage: 521118\r\nlast-modified: Wed, 15 Oct 2025 01:09:54 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":20298,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (20298), with no line terminators","md5":"183cb263396f0b39789db1ae3f1e1b20","sha1":"502fcf18fa8d865213e282824ab2dfaadb9b8beb","sha256":"6a91c12a6fd1664f4d594040374fda61fe5b02fd3aee5f0c877ccbfc49488ec5","sha512":"ef280b60fa9f4bcb446d952f59a9b89442b6da6737bddc20a8fb38fcf0b4083170c09c008d7d221cf205084c8342da1f995bdd99ce907d70e8e14fc62d827acf","ssdeep":"192:nvqx/EhNINclXsfg0S0Q8CqA3ukLzSJFzvQVMZnUIfIxIRhpTpeuHjPtcmx4v78l:gM78Sr3fWJFzouRUqWQhpTpdHjPtc5G","tlshash":"bf92972047aed01967efa82364d36dff71d444db90523eeaaf5a7352cd821f231ea214","first_seen":"2025-06-11T00:07:11.687997Z","last_seen":"2026-07-08T04:13:28.550133Z","times_seen":37899,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/partner/partner-6.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.895Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/partner/partner-6.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4525\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4525,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 130 x 35, 8-bit/color RGBA, non-interlaced","md5":"fc41f4a53986aa873fbb5d6d9480e7a8","sha1":"ec5fda8c50ae629693b80cfb833e8ecfccb94c0d","sha256":"aff05b470f5f5b13fced8c6f71ea75389014ff83831ce96512b8494304ce8c33","sha512":"85253276198c3e73fd3d5a8a658169da010ad1479beb5ed9d1476095464447ae60027e2cc5cb132de08f3488a1d635b491339d81822901f1b8fcd0e70b25b999","ssdeep":"96:l0ljl98zyFpJxVoEkWgNn+2NeNK5l+cwbxewTJe4:mszyFpJF5snzNepcExeGp","tlshash":"c0918d97199a443f63f8421f8b6d48672f4cf5a810d7f6ef4b500a203627b0f3655a28","first_seen":"2023-11-12T08:26:57Z","last_seen":"2026-07-26T06:29:09.089651Z","times_seen":1312,"resource_available":false,"data":null}},"time_used":135,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":130,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/chart-img/chart-1.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.907Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/chart-img/chart-1.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 470\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":470,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 73 x 25, 8-bit colormap, non-interlaced","md5":"b8a8d813b7c568f2b67946e982849db8","sha1":"1eb599fd13d98b754576447d2293fd61e74c8c61","sha256":"5ba5170dfd922182cdf09481c0e70c3694eedcff35a61d6c146dd031a6f5eb92","sha512":"18cbe818a68cf02983b06ab3057bea38152b514ac402ce03a9e7be81b6180b1eb845f0de6176a313aeadc94d9959a24d111cb470939e658b6de231cc13fa1474","ssdeep":"","tlshash":"2af023d6f409ee58b73960674e3acf108572bb9210045d04dd33c13546f734486b7d80","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.028838Z","times_seen":1284,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"translate.google.com/translate_a/element.js?cb=googleTranslateElementInit","fqdn":"translate.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.250.74.142","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.043Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:51:06 GMT","end":"Mon, 23 Mar 2026 19:51:05 GMT"},"fingerprint":{"sha1":"A8:07:E4:29:1F:DC:18:F7:9D:4E:B4:B1:E3:DE:8B:8E:C7:50:9F:F4","sha256":"D1:3C:D1:40:94:0C:B9:C2:51:D7:CA:E9:9A:B6:25:51:0F:E5:17:F1:6F:FF:2E:58:C6:FA:6A:72:54:B1:96:46"}}},"request":{"raw":"GET /translate_a/element.js?cb=googleTranslateElementInit HTTP/1.1\r\nHost: translate.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: Mon, 01 Jan 1990 00:00:00 GMT\r\ndate: Mon, 26 Jan 2026 10:59:50 GMT\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":81716,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2082)","md5":"23d0583afa6762f38c7ca574804885c8","sha1":"a7c2fb85f7ceddffadcd6314a894a19ab2fea25d","sha256":"96ebfd199ce98a52df20ab3ca7860c5c068fa776d81a994eee69df6599a57802","sha512":"77a2cb18d4880af5c1eea0314f98609a2d756398aef0df2d4ba96c7e0556747dfc527a8b0ee5f9265bff9cf3f8b8e8d8598543981c0fa03c4ee661429bb4656a","ssdeep":"1536:X3vdWjCj72+e9JCTUHdBjHvK4eb1wh3N4eOdDNeziwwNWr7:XO+e9J3jHvK4EJgzio7","tlshash":"c283b7ccb6a670658263f5b5413f000eb23f59a9f8084dacb288d8e1adf4959417bf7d","first_seen":"2026-01-26T10:26:29.426237Z","last_seen":"2026-01-26T11:00:14.393265Z","times_seen":2,"resource_available":true,"data":null}},"time_used":587,"timings":{"blocked":196,"dns":37,"connect":8,"send":0,"wait":28,"receive":0,"ssl":316},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"translate.googleapis.com/translate_static/img/te_ctrl3.gif","fqdn":"translate.googleapis.com","domain":"translate.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.138","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:51.657Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:24 GMT","end":"Mon, 23 Mar 2026 19:52:23 GMT"},"fingerprint":{"sha1":"43:39:AF:0A:74:F9:2F:1B:C0:1E:4E:89:21:30:C2:28:EC:9F:6C:67","sha256":"EA:F1:0E:C7:36:18:F3:9D:D1:D5:34:23:44:7D:6F:9D:2F:61:C7:81:09:9E:E9:C8:02:C8:F2:2C:0A:83:B3:A5"}}},"request":{"raw":"GET /translate_static/img/te_ctrl3.gif HTTP/1.1\r\nHost: translate.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"static-on-bigtable\"\r\nreport-to: {\"group\":\"static-on-bigtable\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/static-on-bigtable\"}]}\r\ncontent-length: 1412\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 23 Jan 2026 13:26:22 GMT\r\nexpires: Sat, 23 Jan 2027 13:26:22 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 03 Oct 2019 10:15:00 GMT\r\ncontent-type: image/gif\r\nage: 250409\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1412,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 84 x 19","md5":"9afe50090c0bc612953d081295eab5b1","sha1":"71a4da2a622879c29176ecfa5afe1bbe3e8cfa40","sha256":"d228d0256370863119c043f1e5ca8f3930f6999bd9f250434b6d8935f45dc171","sha512":"d7290b951cec51994f3480c32b70de0faeca433b5d99209b044e1d4c12327768de8c344b6bded806d993251e0ee6f98f0dd64f4480e999fbc06abfe3dd8056fa","ssdeep":"","tlshash":"042182b5cc99114a5be1bd27a334899da8b12c56c38d74595436bdb43470f098422812","first_seen":"2023-04-05T08:27:37Z","last_seen":"2026-07-26T06:37:18.707324Z","times_seen":14214,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/images/197375.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.933Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/images/197375.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 22668\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":22668,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"b4a241ab7581cec5290118ceddb37bd1","sha1":"0b9925bc2676310d006f67cc2b856f158311569b","sha256":"e74d72b279797f0486c4659a646354c787a55f7c3f062f7ca91d6fc35e097f95","sha512":"1ad0de7fdda06be768174805ab7adc1f1997ef6e84dd0d8f555182036f9b652080fe5e1b3f39539adbae5ba884a2bafbf6827ecb08808a1ed01bdf770daff818","ssdeep":"384:u8qi0vYPlnzH1/XtHktr+wIWdTKEmYYwhZNiWqMP7sriGbV9knwxRMxCxGIT:uo0vgxXtEtr+Vem4PVkuevkIRlPT","tlshash":"1ca2d102e90501c4813ff887a252b6dcd91ffc0d0fe7138aa3b94a6eaa5715fc45d239","first_seen":"2023-11-12T08:26:57Z","last_seen":"2026-07-26T06:29:09.06273Z","times_seen":1461,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":147,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/chart-img/chart-3.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.917Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/chart-img/chart-3.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 462\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":462,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 22, 8-bit colormap, non-interlaced","md5":"93371548ccbe732f0d4da146e655a847","sha1":"713328fc5b2ba4605d234f8fc6a447d4e80fb081","sha256":"65e31de86753a271f5b52be6716a181ff8931fbcd48a4f056e65e275e690d6da","sha512":"bbc03e8d358fe0d35c38b9e7ceffb6c9628ef69ba8152168349aacf1d462940f8923456a7a0215f1d524ee467bde7192756b861de7d843be0bb2dedf89a42741","ssdeep":"","tlshash":"c5f0abdae5e8a82bcd6949fac73c983d2a463e44200d2007e814382b9eb9c408658a48","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.065205Z","times_seen":1282,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/flag/canada.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.922Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/flag/canada.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 801\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":801,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit colormap, non-interlaced","md5":"43508a151ab884d973520b83487b4ccb","sha1":"5379f54f4468a64d2c0c9512b2df7a7936ec043a","sha256":"579aea648f78215dac32b2c68101a5cd62b03d868d92a63c4b70545f1bd1aa78","sha512":"37cd272abd993d706f9b059a0dfc31cb3d1c49cf3619c370436318267ff91f717c8eb61f9a4535ce4e4218aec909f85fd95fc41741c76875c70f6166e4c4cf70","ssdeep":"","tlshash":"5901c58e730880cced46589283badd81607a15f014babcb13201052dd152bff8fccaab","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.037959Z","times_seen":1335,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/fonts/flaticon63cc63cc.ttf?cefae1a4bb47c2f93f732cd251c9c01e","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/fonts/flaticon63cc63cc.ttf?cefae1a4bb47c2f93f732cd251c9c01e HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/temp/custom/assets/css/flaticon.css\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:50 GMT\r\ncontent-type: font/ttf\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 20165\r\ndate: Mon, 26 Jan 2026 10:59:50 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":34936,"size_decoded":0,"mime_type":"font/ttf","magic":"TrueType Font data, 11 tables, 1st \"GSUB\", 16 names, Macintosh, type 1 string, flaticonRegularflaticonflaticonVersion 1.0flaticonGenerated by svg2ttf from Fontello project.htt","md5":"ca8030904ed567a42f1dca62d90c5043","sha1":"c1f31d849c90b8815bb080068aa45aeea24e3d63","sha256":"506d72967add3dbedaaff32751d8d2dd5ae16e42771043148bc3c5d54515d8db","sha512":"bafd57abf0ba2e26a4583aa9d8ed75ed3f22c22add2b36d3c61d3239f36b1b2e429eff02c045c7b849458877cce6d50bd7d25a587f9561b4e334d853e08ede5e","ssdeep":"768:D0UbwR62v2kfJw1ssaJnqmfzOhXsoRvr1tksU:DFbwRF+kfydaJqmfrObk5","tlshash":"b0f27bbf735f4e3ed3233abf9cc865224ae1a90815a379836d8d690dc9160c42ef0259","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.038718Z","times_seen":1418,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":28,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/css/responsive.css","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.876Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/css/responsive.css HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 3160\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":19549,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (19549), with no line terminators","md5":"41f6f258e711bd2f007f2fa62ead6217","sha1":"7fde53fc9fcb23d73eff3c8e9a0194e33c0432ff","sha256":"a8b7d048746598b7abfaa4e69644003831806e2a4d87e8a702d49fe949e144b9","sha512":"2c2a6c94e122c0337dfc55ee32f5b8fba21c63722814f8bcfe22b2f8b971e8374cd12660c357d5a017117082161ebd9fd455e79e8bc3aaf66df53855ca76915f","ssdeep":"384:WtWRoiBxVVdRr3Os0djy9ScnTUUHaeXTl0vwzaxEF:lRoiBxLOs0djy9ScnTUgB8w2xm","tlshash":"d292359323160b3de12b4822408d72f43f199a72d7a742fe9d154a2adbcd3b713b4b19","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.076985Z","times_seen":1421,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/chart-img/chart-5.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.923Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/chart-img/chart-5.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 452\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":452,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 92 x 17, 8-bit colormap, non-interlaced","md5":"e3a4eda0513a1b921ff926d9d93d4f76","sha1":"f297d2ba283fb256eeb948e945721f8f53daaf51","sha256":"95b9133d00730f47385e1beac188df6493a3c17d694c6a5d3c808b7c8081dd4a","sha512":"a061bf8205b818f45b57e5cf688cfa9b74921b285a497855c27326009619586d76fdef8763b8f40f8ebefc8c9a67c5385182b681856424dc93d14c56f31b1f60","ssdeep":"","tlshash":"8ff0f8c293d66a2eda540af5cfaaa31ce0b03c4a0e744e0f4c532e0b566010a1a8009a","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.068743Z","times_seen":1282,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"code.tidio.co/682c7989b3c3dc190a709adf/1irmrlha7","fqdn":"code.tidio.co","domain":"tidio.co","tld":"co"},"ip":{"addr":"104.26.0.115","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.976Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tidio.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 15:34:02 GMT","end":"Thu, 26 Mar 2026 16:33:45 GMT"},"fingerprint":{"sha1":"AC:94:45:87:7A:5F:68:0F:28:F3:B6:CA:C2:3C:81:F5:9D:9F:5F:F7","sha256":"6E:9D:EC:3F:A9:1E:F8:04:E5:19:DF:C8:60:0C:B0:21:EA:01:CC:E3:26:84:69:37:D1:91:1C:80:81:C7:33:3B"}}},"request":{"raw":"GET /682c7989b3c3dc190a709adf/1irmrlha7 HTTP/1.1\r\nHost: code.tidio.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Mon, 26 Jan 2026 10:59:50 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 9\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CKBzjv47TBVC1RJUdelnVx3BfU%2Btl2DG7h67Supic882Xiz6wcZCaamC92j2cnLs4iQg2yMqo1Ge7qVGvNDoZldwfvi8RDLu3yE%3D\"}]}\r\ncf-ray: 9c3f80cccef15696-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T07:24:10.984473Z","times_seen":17541736,"resource_available":true,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":1,"send":0,"wait":195,"receive":0,"ssl":22},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:51.066Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:23 GMT","end":"Mon, 23 Mar 2026 19:52:22 GMT"},"fingerprint":{"sha1":"5A:74:FC:38:D2:7B:9B:E5:E5:0D:67:25:F4:73:BC:BA:2E:12:A7:FD","sha256":"3B:19:CD:BE:44:E6:EE:DC:8D:33:2B:A2:1C:E4:13:F8:6F:7E:2E:52:5D:0E:75:F3:1A:ED:21:1B:7A:B7:2E:BA"}}},"request":{"raw":"GET /s/i/productlogos/translate/v14/24px.svg HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ncontent-length: 3340\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 23 Jan 2026 13:19:00 GMT\r\nexpires: Sat, 23 Jan 2027 13:19:00 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 20 Apr 2022 14:24:23 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nage: 250851\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6225,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2bd5c073a88b83ed74db88282a56ddfb","sha1":"d0ebfc376f8c6a44a8d4cd216817dcd7d0c33650","sha256":"ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09","sha512":"5c6c4a92e93fc0f6a675658cc84f6187fdebd3eee94efd07e24658736cba598f3bc7156b19834b13fb44c1d43fcb7df9fcca7f0a453037e30da76ba8f4b23b89","ssdeep":"96:+R2K3Z4n7tyVwip82hezk6227gLFoXhu1XuE20ot+pVY3YptWDzOzgXK3Zx:ql3KnxyGGMzb7noR20NTww33","tlshash":"c1d1e6f19309d815cd6a83d8cd9b8002aa1f25ddd50ac6cc7639fb3bd1a50eb1d2d7a4","first_seen":"2023-04-06T21:34:37Z","last_seen":"2026-07-26T07:04:49.594633Z","times_seen":75438,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/images/branding/product/2x/translate_24dp.png","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:51.126Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:29 GMT","end":"Mon, 23 Mar 2026 19:52:28 GMT"},"fingerprint":{"sha1":"D2:3B:6C:71:A7:BD:CB:B5:56:D1:90:EE:91:17:19:0F:24:02:E5:93","sha256":"DE:C3:87:EA:0D:EF:DF:B6:5C:9C:CE:F8:48:EB:2C:CE:06:FC:22:FD:3A:57:71:FF:23:81:1F:16:8F:67:66:B6"}}},"request":{"raw":"GET /images/branding/product/2x/translate_24dp.png HTTP/1.1\r\nHost: www.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.Qrtd5lGlzn4.L.F4.O/am=AAQD/d=0/rs=AN8SPfo9mDPo5pOm0HC4yPcwcdDdHSiNXw/m=el_main_css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"static-on-bigtable\"\r\nreport-to: {\"group\":\"static-on-bigtable\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/static-on-bigtable\"}]}\r\ncontent-length: 1842\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 20 Jan 2026 22:58:51 GMT\r\nexpires: Wed, 20 Jan 2027 22:58:51 GMT\r\ncache-control: public, max-age=31536000\r\nage: 475260\r\nlast-modified: Thu, 14 Oct 2021 09:08:00 GMT\r\ncontent-type: image/png\r\nvary: Origin\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1842,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"c69c796362406f9e11c7f4bf5bb628da","sha1":"e489ce95ab56208090868882113d7416abf46775","sha256":"4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82","sha512":"d3ad560ed0fd29be7d2cc434694f09e5a6fbea8b29c0611aecb54a1b73b4d722c53f42a19dae9e3d5d358444e50fb8fffbc39d67ce751bdbc8c861f6f95d3162","ssdeep":"","tlshash":"4e31f9fd129220437101ade72165eef798347c15f412da60ce65ba389c9fe20ed9a619","first_seen":"2023-04-05T07:39:29Z","last_seen":"2026-07-26T07:04:49.593185Z","times_seen":70532,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/raleway/v37/1Ptug8zYS_SKggPNyC0ITw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.509Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:23 GMT","end":"Mon, 23 Mar 2026 19:52:22 GMT"},"fingerprint":{"sha1":"5A:74:FC:38:D2:7B:9B:E5:E5:0D:67:25:F4:73:BC:BA:2E:12:A7:FD","sha256":"3B:19:CD:BE:44:E6:EE:DC:8D:33:2B:A2:1C:E4:13:F8:6F:7E:2E:52:5D:0E:75:F3:1A:ED:21:1B:7A:B7:2E:BA"}}},"request":{"raw":"GET /s/raleway/v37/1Ptug8zYS_SKggPNyC0ITw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://northwesternunion.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48264\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 23 Jan 2026 12:29:36 GMT\r\nexpires: Sat, 23 Jan 2027 12:29:36 GMT\r\ncache-control: public, max-age=31536000\r\nage: 253814\r\nlast-modified: Tue, 09 Sep 2025 19:08:31 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48264,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48264, version 1.0","md5":"e401cae7a12911a5c9752dc7a62f9dd7","sha1":"5685dd613a8a8211bf60b4b10753a47587bd0b60","sha256":"b1bef1f03a77a36fc257c5525e32a1dd621bb6f935b743a419da7ed0b18dc8f5","sha512":"dc8b6f28bc048efb508b482199c958ffaeddf15431aad34544f5b9972fd8c19e0315f74499d5549b30e15a03e41bfaf2a30613b6889b9a693a9c87c4e872e1f3","ssdeep":"768:AWHBpvVWVHIgyYwXiDAOa6GWeFGaCfLBc/qiufIdQRuEl4ofxl8VKme:AWbEIgmi8uAFCfS/OfUYuRExl8VFe","tlshash":"1123f2e56c6a826bd88c882945ee21c1f3d7f4927713d149e8fa5df8c432c05ed5066b","first_seen":"2025-05-29T19:02:42.430777Z","last_seen":"2026-07-26T06:30:21.494151Z","times_seen":61732,"resource_available":false,"data":null}},"time_used":171,"timings":{"blocked":63,"dns":1,"connect":21,"send":0,"wait":26,"receive":17,"ssl":39},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/about/about-img-5.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.897Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/about/about-img-5.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 141805\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":141805,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 480x650, components 3","md5":"5e2a9a8715ef44bfcc4419c54e7d9906","sha1":"9534d84ea5d0a143bfc6ed695f7d9aab4058f9c5","sha256":"1cf2e1d7c174d3155616e66fbe49a1f0458de06c643cca6c9d1a056ce526aae5","sha512":"1f4b821f50e90980d14e89a77682166006ba52bd5dfc709f1ee8ae305ae3973c6406c321fbba66d236c6a1f8991303299444e90dfe49cb35e70abea1f8d220de","ssdeep":"3072:lQfm2Kp4kslg26ZJkyBAvzHibrkW4o8newrZ7B/IokyJran4MhYkx2:l8yxsq2eryb6odnew97B/Van4IFM","tlshash":"ffd313b89c6aedc74804813b3f1b42aae9fc95c2f1c76a113356b955c8f4061db7703a","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.085254Z","times_seen":1329,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":83,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/flag/japan.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.908Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/flag/japan.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 676\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":676,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit colormap, non-interlaced","md5":"d6d8f49eb74c68abd38daee5abdd0846","sha1":"59da5e99ad295277d09a2a1e0d14ebaa04ac75c9","sha256":"775b622f42ac6d8adad96c7648ccc994c542ee70cd400e77ca9cce9d4b8ee03d","sha512":"f93fbfc102bfad1b05f118085f424210180c96c5dd483c81db46a44a1d8de9b35a9d019c9ba917fad18022061134c14797b6c7975792608d446468c673441006","ssdeep":"","tlshash":"6c01fe73383ae4650cef0acfb27d6502a4a646011b22fb487b4634ed64dcc4969b32c0","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.094722Z","times_seen":1337,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/testimonials/client-5.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.936Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/testimonials/client-5.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 21569\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":21569,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 200x200, components 3","md5":"f75371f848157b639ca47a4d97fe61b1","sha1":"43d0633b744d3f35897d67179b22ce4591a3cb90","sha256":"00b5e239f9e62e1be8f00408d8551a87a14542e0cf1d46b5e405ef000135b455","sha512":"89996ad5a134bce17b5b8e1f448621cd4404e11eba12722ba3b875f26a67bdc7a909493dc77ff0549cbf4c1641b2a08eff5a36d66ae4d6a031e48a768adc1610","ssdeep":"384:LSRA9lhtmhdQZM5eOWgwNKFaRLQlvXxe0QzkcQzqjt/YXW0ngd:G9eOGNua5Q9XxeTkfWZYXW0ngd","tlshash":"27a2e190d9968388e9b9f534761433f37a800fb216979622afd1a0f9d71815f047cf7a","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.088187Z","times_seen":1357,"resource_available":false,"data":null}},"time_used":152,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":151,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/popper.js%401.12.9/dist/umd/popper.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.244Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/popper.js%401.12.9/dist/umd/popper.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://northwesternunion.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 400 Bad Request\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=86400, s-maxage=86400\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/plain; charset=utf-8\r\netag: W/\"3e-rVTZaEP/IducDerMLIXX9cqTIf0\"\r\naccept-ranges: bytes\r\ndate: Mon, 26 Jan 2026 10:59:50 GMT\r\nage: 81097\r\nx-served-by: cache-fra-etou8220166-FRA, cache-hel1410023-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 62\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T07:24:10.984473Z","times_seen":17541736,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.tidio.co/682c7989b3c3dc190a709adf/1irmrlha7","fqdn":"code.tidio.co","domain":"tidio.co","tld":"co"},"ip":{"addr":"104.26.0.115","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.370Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tidio.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 15:34:02 GMT","end":"Thu, 26 Mar 2026 16:33:45 GMT"},"fingerprint":{"sha1":"AC:94:45:87:7A:5F:68:0F:28:F3:B6:CA:C2:3C:81:F5:9D:9F:5F:F7","sha256":"6E:9D:EC:3F:A9:1E:F8:04:E5:19:DF:C8:60:0C:B0:21:EA:01:CC:E3:26:84:69:37:D1:91:1C:80:81:C7:33:3B"}}},"request":{"raw":"GET /682c7989b3c3dc190a709adf/1irmrlha7 HTTP/1.1\r\nHost: code.tidio.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Mon, 26 Jan 2026 10:59:50 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 9\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=may1RboDGfbClbhLu3KDqxwM5jjVarIgR1byqVCwB%2BMfnid%2FHpJvkKEv1TxfIfgSLuo92yHOwBCuaOEgDr9QaDf2Z0VreaxYY3I%3D\"}]}\r\ncf-ray: 9c3f80cfd9e25696-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T07:24:10.984473Z","times_seen":17541736,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/storage/app/public/photos/0WkAXBcpl6dS9b6d3XKmQilcsgdbp1Wi6s7p0xtO.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.836Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /storage/app/public/photos/0WkAXBcpl6dS9b6d3XKmQilcsgdbp1Wi6s7p0xtO.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:50 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 26 Jan 2026 01:30:05 GMT\r\naccept-ranges: bytes\r\ncontent-length: 3627\r\ndate: Mon, 26 Jan 2026 10:59:50 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3627,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 103x126, components 3","md5":"12b76f8337924b5bac20eee8b27aab26","sha1":"b25a1c254ad179425b5fcce8eb7d3045fd7544a1","sha256":"2f91e24276928bd9534c98553b4f0f2c5b13f9870a9b17f28b0f3bcaa9c95ee5","sha512":"946aed15f9a9a512bef2d588462cedc0b430ce8163c7f0cd6b24848c00d1a56727dce8282b0b947cb9abc642cc119362507bc862eb4b0be1551e5d5c4419f553","ssdeep":"","tlshash":"26713d1bfb6ba153dd23d7b541a50bb2f7445c629e095b8f2bd040c33826ce94442695","first_seen":"2026-01-26T10:39:00.032499Z","last_seen":"2026-01-26T11:00:36.990504Z","times_seen":3,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/storage/app/public/photos/7rfV6U8BgvJlOlfcDBQ0MN8qGUdQMTjrGnRuux8w.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.879Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /storage/app/public/photos/7rfV6U8BgvJlOlfcDBQ0MN8qGUdQMTjrGnRuux8w.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 26 Jan 2026 01:30:05 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9554\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9554,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x126, components 3","md5":"58daa6fa1e7ed50b7945cdf0b5c46409","sha1":"c9dd7f2b91adb11e07038c439b975a7979b2b664","sha256":"c7e84212feec193828a810737009bb2271f738dbddbeca545177243f0ca35f87","sha512":"79c0badd17d4e885c83ef1d399c19aff06699a96771b112fa6edbed6b33675695df3836b6cae8c1bdb97a47d3ba217f4f188742a2d3f2e438b480e24bad421a2","ssdeep":"192:03KdlD+Vb2/3nf7DqXVAjaBOfgpgJHf7Gu/z6jvjML5dAVTxylZq3:03KXkynqXpBKgQfX/0MsLH3","tlshash":"4d129fca375870ecc763c13b883c4fca23779bb9d989025ff1b4275615681984ae89ec","first_seen":"2026-01-26T10:39:00.049512Z","last_seen":"2026-01-26T11:00:36.988602Z","times_seen":3,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":77,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/shape-2.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.898Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/shape-2.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 519\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":519,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 55 x 50, 8-bit colormap, non-interlaced","md5":"0ebb76b1d4f0c812b15c580a9d4f31c6","sha1":"39976fc87dff1ac0b6f0ba6a75324a318e0aefbf","sha256":"5c7e35d5c7a4a76e878b644d412a529023fa9719915f1849b8cab2dda9ad56ae","sha512":"402cd9d6fc95b1ef4473fe11e14037b972cd32b01b7343501a722fc90fca919c8132b4de15b5b2b34f31cfcf4d53c90ce9cfbadfa3d8377a93734cd37b4aa5aa","ssdeep":"","tlshash":"86f00e82ebbced78a51286aa47314821823a73082011304aa833b0389af978ac5d39c3","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.086014Z","times_seen":1355,"resource_available":false,"data":null}},"time_used":147,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":147,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/raleway/v37/1Ptug8zYS_SKggPNyC0ITw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.510Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:23 GMT","end":"Mon, 23 Mar 2026 19:52:22 GMT"},"fingerprint":{"sha1":"5A:74:FC:38:D2:7B:9B:E5:E5:0D:67:25:F4:73:BC:BA:2E:12:A7:FD","sha256":"3B:19:CD:BE:44:E6:EE:DC:8D:33:2B:A2:1C:E4:13:F8:6F:7E:2E:52:5D:0E:75:F3:1A:ED:21:1B:7A:B7:2E:BA"}}},"request":{"raw":"GET /s/raleway/v37/1Ptug8zYS_SKggPNyC0ITw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://northwesternunion.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48264\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 23 Jan 2026 12:29:36 GMT\r\nexpires: Sat, 23 Jan 2027 12:29:36 GMT\r\ncache-control: public, max-age=31536000\r\nage: 253814\r\nlast-modified: Tue, 09 Sep 2025 19:08:31 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48264,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48264, version 1.0","md5":"e401cae7a12911a5c9752dc7a62f9dd7","sha1":"5685dd613a8a8211bf60b4b10753a47587bd0b60","sha256":"b1bef1f03a77a36fc257c5525e32a1dd621bb6f935b743a419da7ed0b18dc8f5","sha512":"dc8b6f28bc048efb508b482199c958ffaeddf15431aad34544f5b9972fd8c19e0315f74499d5549b30e15a03e41bfaf2a30613b6889b9a693a9c87c4e872e1f3","ssdeep":"768:AWHBpvVWVHIgyYwXiDAOa6GWeFGaCfLBc/qiufIdQRuEl4ofxl8VKme:AWbEIgmi8uAFCfS/OfUYuRExl8VFe","tlshash":"1123f2e56c6a826bd88c882945ee21c1f3d7f4927713d149e8fa5df8c432c05ed5066b","first_seen":"2025-05-29T19:02:42.430777Z","last_seen":"2026-07-26T06:30:21.494151Z","times_seen":61732,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":62,"dns":0,"connect":21,"send":0,"wait":43,"receive":14,"ssl":37},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/css/owl.carousel.min.css","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.865Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/css/owl.carousel.min.css HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 920\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3357,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (3185), with CRLF line terminators","md5":"87abab2867922fef553680ba678dfa06","sha1":"38e873c124fb121992f7353080c62de7ff47c1ad","sha256":"eefff6e8d13f576add7c73285b00d6ef56d3d1d6e6f98af8561fd3dbf47500b5","sha512":"dbb7f9cf9d1f47ded41384e422050d480a1f718b9c5b15516869fe9b44cc18aa478471d589fec1e024e3c81354be71f64da311702f059dfbf515ef73b400e5e4","ssdeep":"","tlshash":"1461cbe5314a225f480f831219d81e86393dcc52d8660a8a92bbd31447dae6d213ffcf","first_seen":"2023-04-18T14:12:09Z","last_seen":"2026-07-26T06:29:09.026387Z","times_seen":2261,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/hero/hero-shape-5.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.881Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/hero/hero-shape-5.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1204\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1204,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 33 x 36, 8-bit colormap, non-interlaced","md5":"15cdeabd4f3cd0386e7557ab0c2c2fbd","sha1":"b85c817311204185520d819bfba5b2d68aaae19f","sha256":"817769cfe84fed4edce7451771448f921384e09f73364ea105924ca25a01c305","sha512":"86561281d81b263b73a1f94295f6e37380d074e05bd46cdb6bc7bbb907c09a45d52251e30d42dc64ddda2b4ea0955c0a0c155a803bfc6b18726997e5eeb825de","ssdeep":"","tlshash":"1421ba897809bf1ac6df763d4640b878cd4d78149f00c6060fc55a6c0e96bdd37d4516","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.08675Z","times_seen":1338,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/contact-form-script.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.981Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/js/contact-form-script.js HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 425\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":895,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (895), with no line terminators","md5":"250bc40cc9bf0311ff49a31cb3fdd96f","sha1":"75b049495fd4ad8f8dba66abef363b74fa50b326","sha256":"01f88dcee3ea695865770808ba43f18d9b0a0db51696c39d69ea2a607c108e78","sha512":"7ba4df3992f99eb5cf3fc7ac3e4977218b0fe6d57912885197931701943e4a0d33d36971b70b656090d84bce351fccee973727bff9d85294c9dcc7d1c5350487","ssdeep":"","tlshash":"1811d012341429d9033b2bf9700e3602b3711a34c9bde91520b0b9cdbf78d9836a3316","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.031863Z","times_seen":1527,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/why-choose-us/wh-img-5.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.901Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/why-choose-us/wh-img-5.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 67987\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":67987,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 350x330, components 3","md5":"083d0f173a285cfc0eb53e99897bc5f5","sha1":"d469132a26088e0fcf6145047ab66d62f563dbc9","sha256":"d064673fb05387d838701073bb4a7647c713d341338fa3ee20c42d27b12e09d1","sha512":"77331315e43d22ca8cd1d7f718c1e5c402055bac9b9c987626f8008c4dd61a23dfdf4457e05983ff3618f9dc06297a65309ede467ea5e834c61170671b65e382","ssdeep":"1536:98qroSdUhTMeWoDtKAE5Sfe9WDOimovxvIlzSB/NbiY:9Vrn+hTfWoDtKTs29WDOYv9hN+Y","tlshash":"e663020f56007ceb8aaad24280f545dcf7551ba665b312b4d247beed412973bdf24c0b","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.042444Z","times_seen":1327,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":148,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/shape-1.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.896Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/shape-1.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1166\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1166,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 46 x 49, 8-bit colormap, non-interlaced","md5":"3083080a6061f2145dd6034a07f3b466","sha1":"22330aabb755df270ae0abd601bba8ec9546ac4a","sha256":"cedd61e88f5aee5bd98568302612740a234ef7f9039ed5d52f749fdae7b4d8a4","sha512":"6283e9c9df859df0d4e7d4b64530be8c37595649c4c3a5ec14f508c7cb67649786642dbf73cb625d930128a934953015b1b5fc6ff0a79f33d0f9bc523a5e30d1","ssdeep":"","tlshash":"4621938ee55ccce4de10017189a31d950511b56c0c034100fa3b31beecdf08c86d0b6b","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.075491Z","times_seen":1352,"resource_available":false,"data":null}},"time_used":132,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":128,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/blog/blog-1.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.938Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/blog/blog-1.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 146739\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":146739,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 565x400, components 3","md5":"1a204446aae01ddb18add26e1aef1cf0","sha1":"74c5be7f2130aeb6abd5c4771f1d3b688ca4e352","sha256":"87fec55557cfa10c01ec8981f5ddac8ee9be98836b5dc05c32566107ee43c5e1","sha512":"000dee354a645e4b171a438800cb0ab5b0ffcebf04c3af64c1eb4fbc6f370a038ad9b772ae4563bf4eb3044c1f9614da8af00a99c214ebab8374f133e88e011f","ssdeep":"3072:KalLJQKWDAWNMjUb16xrrs8BkiKhpFonssAfYjCOcUKBnefd:HQRDAWNMk1aOyssAgCOcPad","tlshash":"31e31293a91747b5e55b0dbb00caef1c121a4bc676f811c9367c97a206b939a74ce2cc","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.080353Z","times_seen":1320,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":151,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:51.128Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:29 GMT","end":"Mon, 23 Mar 2026 19:52:28 GMT"},"fingerprint":{"sha1":"D2:3B:6C:71:A7:BD:CB:B5:56:D1:90:EE:91:17:19:0F:24:02:E5:93","sha256":"DE:C3:87:EA:0D:EF:DF:B6:5C:9C:CE:F8:48:EB:2C:CE:06:FC:22:FD:3A:57:71:FF:23:81:1F:16:8F:67:66:B6"}}},"request":{"raw":"GET /images/branding/googlelogo/1x/googlelogo_color_42x16dp.png HTTP/1.1\r\nHost: www.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"static-on-bigtable\"\r\nreport-to: {\"group\":\"static-on-bigtable\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/static-on-bigtable\"}]}\r\ncontent-length: 910\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 26 Jan 2026 09:59:07 GMT\r\nexpires: Tue, 26 Jan 2027 09:59:07 GMT\r\ncache-control: public, max-age=31536000\r\nage: 3644\r\nlast-modified: Thu, 02 Nov 2023 22:48:00 GMT\r\ncontent-type: image/png\r\nvary: Origin\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":910,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 42 x 16, 8-bit/color RGBA, non-interlaced","md5":"efa6bb2bfe459bc6f4bdafa3db0383f6","sha1":"52d15ce52fe50643e542c17812de43f4ed1b6ee0","sha256":"6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2","sha512":"e23c04d8997f5c2f92070e09261b7ee50d9df8753f45cf66f604f0874ffa8d99e947c97c528ec02a2c3fbe8e43d840b343a7d0225532980d5da95031216415b7","ssdeep":"","tlshash":"491184a73cd1dc6854a47a87aa91b864ec250f1b91a220981237b42277313444fdc8f7","first_seen":"2023-04-05T07:39:29Z","last_seen":"2026-07-26T06:37:18.668705Z","times_seen":53306,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/chart-img/chart-6.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.927Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/chart-img/chart-6.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 669\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":669,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 89 x 20, 8-bit colormap, non-interlaced","md5":"78a60559b34e8dd28b65b95903036c6b","sha1":"965f510a8283effd5154049e6db5d6569da7edd6","sha256":"6ede0ad128484c30e39ad7dbe5881844bea4360d7d0f65d8831597e0b058139a","sha512":"c3391299c37c1f097c04cc1091e8950102b486b6e1b823745ba43046f327e70071b8277950c118f641bc50b4d26ea69db9e98fa5bd424f53008a3eee55e6582d","ssdeep":"","tlshash":"f701239ab9458dad7771b09d03220f0591743b2023087a145db3d0b14adff09c222741","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.02806Z","times_seen":1282,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/testimonials/client-4.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.935Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/testimonials/client-4.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 28230\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":28230,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 200x200, components 3","md5":"04fc1ce1a80a1ff934ed63d7c439a5de","sha1":"057c48e27645778485beeb5965d046d7ac545893","sha256":"cd322a5aade9d9947c3dc9c9f846bb0b942dbc569e6cbe3bdbbb79246bd7b151","sha512":"cc9094b4d5b1e41f852f8d0f9e46dee475b8e72697d789bf0aa8859082e32e922efc35b694cb8b7e9ae37c031db8c70c54348c4fab51997e9bfb7f8790be9650","ssdeep":"768:4kzuA5cufgMAaSY2m7NBvcsoqHJ+Gv+1Cj:Bcgg1DJqp7yu","tlshash":"00c2f123f15aa446c4903d7811b2c28e9ccde362ce47da25379158ebf6077f8338e565","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.052722Z","times_seen":1365,"resource_available":false,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":150,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/hero/hero-img-3.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.887Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/hero/hero-img-3.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 102249\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":102249,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 350x600, components 3","md5":"32acfb8082f7ff4363ce4b51eea98d2b","sha1":"26959509e5121feeb3adb0ba06acce1843f70c86","sha256":"3f98d875cae7c7f85488ecbb017113e566bd8e81dc56d0bb477f67d38c551a2b","sha512":"1cfdd9ff30e5d8e7f16bcca9d872ef8623d549cb5361b5f2dddcf603eed302519f1bcf7bbf3c966a9d07651a9ccaee5ab6cff3f22945747977cb33fad5bdb30c","ssdeep":"3072:NsteC/gX9dIIfEgyGFXZ/BzpnaAZN40S9MhCnsE4Y:2eC/RoEgyGhxBznN8w6HB","tlshash":"60a31238a7c292286cbc0d56b5f195d3978ba62fe77f931e987cc947cf42100e486a70","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.051335Z","times_seen":1332,"resource_available":false,"data":null}},"time_used":136,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":88,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap%404.0.0/dist/css/bootstrap.min.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.841Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/bootstrap%404.0.0/dist/css/bootstrap.min.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://northwesternunion.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 400 Bad Request\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=86400, s-maxage=86400\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/plain; charset=utf-8\r\netag: W/\"3e-rVTZaEP/IducDerMLIXX9cqTIf0\"\r\naccept-ranges: bytes\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nage: 31519\r\nx-served-by: cache-fra-eddf8230174-FRA, cache-hel1410023-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 62\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T07:24:10.984473Z","times_seen":17541736,"resource_available":true,"data":null}},"time_used":63,"timings":{"blocked":2,"dns":1,"connect":14,"send":0,"wait":13,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.2.1.slim.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.194.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.844Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 12 Jun 2025 00:00:00 GMT","end":"Fri, 26 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE","sha256":"9A:64:20:6F:F5:DC:F1:8A:D6:B2:D0:93:C2:7E:62:86:0B:1A:D5:24:CF:CE:4A:9F:4C:0D:F1:FB:F2:A0:A8:1E"}}},"request":{"raw":"GET /jquery-3.2.1.slim.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://northwesternunion.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-10fdd\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nage: 4136918\r\nx-served-by: cache-lga21963-LGA, cache-hel1410031-HEL\r\nx-cache: HIT, HIT\r\nx-cache-hits: 38, 84142\r\nx-timer: S1769425190.922451,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 23856\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":69597,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (32012)","md5":"5f48fc77cac90c4778fa24ec9c57f37d","sha1":"9e89d1515bc4c371b86f4cb1002fd8e377c1829f","sha256":"9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398","sha512":"cab8c4afa1d8e3a8b7856ee29ae92566d44ceead70c8d533f2c98a976d77d0e1d314719b5c6a473789d8c6b21ebb4b89a6b0ec2e1c9c618fb1437ebc77d3a269","ssdeep":"1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT","tlshash":"b663d5d9b2c67062db7730b950bf410bf07a98dab44c8c60e198d8d47d78a99817bf2d","first_seen":"2023-03-07T01:02:43Z","last_seen":"2026-07-26T06:29:09.039477Z","times_seen":80614,"resource_available":true,"data":null}},"time_used":188,"timings":{"blocked":55,"dns":25,"connect":26,"send":0,"wait":28,"receive":5,"ssl":46},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/popper.js%401.12.9/dist/umd/popper.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.847Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/popper.js%401.12.9/dist/umd/popper.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://northwesternunion.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 400 Bad Request\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=86400, s-maxage=86400\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/plain; charset=utf-8\r\netag: W/\"3e-rVTZaEP/IducDerMLIXX9cqTIf0\"\r\naccept-ranges: bytes\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nage: 81096\r\nx-served-by: cache-fra-etou8220166-FRA, cache-hel1410023-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 62\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T07:24:10.984473Z","times_seen":17541736,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":3,"dns":1,"connect":13,"send":0,"wait":16,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/css/aos.css","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.872Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/css/aos.css HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1539\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":26053,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (26053), with no line terminators","md5":"847da8fca8060ca1a70f976aab1210b9","sha1":"0557d37454b67f42f2cb101e57e5070fb1193570","sha256":"1aa8845fd06e475aefe733d4e55b36a92fcd487975049c8172341827ac9cc03e","sha512":"d5c2bbf1ad68fa1b7625c696ea0f0e5d8c2aa5ebfdfba1aa3a4cfdc6604df625148489dd2adc7020b19660e4a26ce2a32ec11d8f28d9bd80eafdc67035e6a4d3","ssdeep":"768:CMJihoCcZCOud8G8tKS65wqsZQ1G+dM2cl6iCRotsV84sxIKcv4g01UeEPEQEB4D:CMJihoCcZCOud8G8tKS65wqsZCG+dM25","tlshash":"f0c24b5a7a4cd100bf831b4762df2a0859347588e5301986be3f35ca2cd5ce6b973fa9","first_seen":"2023-04-05T07:18:45Z","last_seen":"2026-07-26T06:29:09.035746Z","times_seen":41937,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/chart-img/chart-4.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.919Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/chart-img/chart-4.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 538\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":538,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 82 x 27, 8-bit colormap, non-interlaced","md5":"aa02aae884cb578bc0a2f1f9bf3f2954","sha1":"ba60f34106249ce0cc7485947434d7d70f411f64","sha256":"141b88a15608b337ef1fe9d476747cad1ce911f92d02c006699c61debfe00ac3","sha512":"caf6a311961b15e9628bb422e93b95131f2194b2f2fbe886de83c753edacd87a19fc243554cdda490889003fb2baa4693efc4ef78dcdee7b11fcad1a157eb2f8","ssdeep":"","tlshash":"67f00e580c70ac36cc969af3f762c03c4901bda5520648033f0c31cb9ee3b908981387","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.072697Z","times_seen":1283,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/css/bootstrap.min.css","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.854Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/css/bootstrap.min.css HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 21197\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":163864,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65302), with CRLF line terminators","md5":"d72fb46fdfcc65998d65ce27889e95fd","sha1":"8aa23d660df97231c14b1d247ff2fcbe25c6fc8b","sha256":"ac9e331eebe875842c3e7605970c374521815c4277502bbb1c66dc57aaeb04bf","sha512":"6c297b6d0bf706339fdbde201b8e4281d521991746ec8be2b9d8192662902cecbaf26845340d26eb6fd9ab0260a883286f0a2377e7a8619c714dceba7d7eb3d9","ssdeep":"1536:lt04T8if0W8DsEBpy0cuJBt2rIWE5e0VUpz600I4fT:lt0430VUpz600I4fT","tlshash":"38f3b4dbf581341dd4a7c259a4d1bffd052f4586e3025aabb0277bb88b892c70963e4c","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.060328Z","times_seen":1455,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/blog/blog-3.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.947Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/blog/blog-3.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 139098\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":139098,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 565x400, components 3","md5":"abecac2374b69bfbf1fbe1f751af2bfe","sha1":"781881d6416298a043e790fdf8746b7f4f298214","sha256":"76097e57ea90ace6051dbb1bd2444a8ccf4dcc9893d600e080938cc509fe6d8a","sha512":"156f7cc6426c41e4bf86205d72d37b64fa3bbb95094631550a9c732b6dea9a2d792e8b8a395183901515457978ac29b5ca1cce75c5391d5a2d5c254bb9ad246e","ssdeep":"3072:cowBbjNObpdlXVA8rAjS92y47Ofs+W1joFTWrP10FxBARtaP:lmvNObjle8UjSJIOfajosxKyRtc","tlshash":"add31258f23bca28a7b2311b45adec80ba0cdf5c291333c7935d2a65d5cf4226f92751","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.041705Z","times_seen":1320,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":157,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/odometer.min.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.007Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/js/odometer.min.js HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 3453\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":10264,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (10241), with CRLF line terminators","md5":"cbbe383a299d4cd3c5afd850e23b93e2","sha1":"a57fab98eed3ee4da231031c823c0dfe71435e5d","sha256":"b98842a571aa1f32f8797a9d08186bb021f258925a8db4fe57d60129b858b1ec","sha512":"85b7267f38755128dff6d6435f050b949d6b99c72290c00d6813b16207c8e3e70ae01300f4269fe28df87960be5ef2211c3ce4929ea36ae866bb0e6ff7f849e4","ssdeep":"192:kABzlvQK8QecCHAOcu2a+OdI5s/GMb8XuulT:vBhv18QecCxVxz+7dlT","tlshash":"3b228580ba11a725835372e151bf0609b7bb99aea404401db67c9dd9be29c38e12bf74","first_seen":"2023-03-07T12:27:14Z","last_seen":"2026-07-26T06:29:09.07767Z","times_seen":2936,"resource_available":true,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/images/cleardot.gif","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.250.74.100","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:51.311Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:53:09 GMT","end":"Mon, 23 Mar 2026 19:53:08 GMT"},"fingerprint":{"sha1":"48:33:DD:3F:0B:48:93:34:93:FB:CD:86:06:0B:02:0A:26:C8:9D:34","sha256":"51:93:52:C6:2F:18:71:EC:3A:8F:29:E1:74:86:FF:6C:A2:EC:19:58:65:2A:9C:A2:DF:E5:86:6A:E9:6A:73:7E"}}},"request":{"raw":"GET /images/cleardot.gif HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: image/gif\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"static-on-bigtable\"\r\nreport-to: {\"group\":\"static-on-bigtable\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/static-on-bigtable\"}]}\r\ncontent-length: 43\r\ndate: Mon, 26 Jan 2026 10:59:51 GMT\r\npragma: no-cache\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\ncache-control: no-cache, no-store, must-revalidate\r\nlast-modified: Tue, 22 Oct 2019 18:30:00 GMT\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":43,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"fc94fb0c3ed8a8f909dbc7630a0987ff","sha1":"56d45f8a17f5078a20af9962c992ca4678450765","sha256":"2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363","sha512":"c87bf81fd70cf6434ca3a6c05ad6e9bd3f1d96f77dddad8d45ee043b126b2cb07a5cf23b4137b9d8462cd8a9adf2b463ab6de2b38c93db72d2d511ca60e3b57e","ssdeep":"","tlshash":"cb900003cac8c022c2a2c0300a0c03002bbaa8300228030ec0bc30fcec2a3a38c02000","first_seen":"2023-04-05T02:54:04Z","last_seen":"2026-07-26T07:16:41.646329Z","times_seen":79306,"resource_available":true,"data":null}},"time_used":196,"timings":{"blocked":80,"dns":3,"connect":21,"send":0,"wait":31,"receive":0,"ssl":57},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/css/remixicon.css","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.859Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/css/remixicon.css HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 12487\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":96447,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"f1f4e764479f95ac22b0b77cf9920d5b","sha1":"c6185202501a6084f83273ad6fe099641f11a8d9","sha256":"3c8d0233a1e66ba081468ad728a3032f70f10a5a5c890b0f9541722cba8a5bc8","sha512":"9cee62ab5c81be3db0750c47cb20030f7f0b2ec6c95638b8a130ea22548b7c01a10f5835ed9091cc74059dae399782f751cbaf15cce47982daa28f258e58bd84","ssdeep":"1536:Fc+QQP3ILxAju/j/mZjblpU0UvDfFawWgUipUwRET5yZ03fIJ3:H3uxF/KPbdwRDn3","tlshash":"3993f2ede64e44c13732c886db74b78a60e9fab6c5815c95f85b500deec76a102c4ebc","first_seen":"2023-11-12T08:26:57Z","last_seen":"2026-07-26T06:29:09.061135Z","times_seen":1333,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/hero/hero-img-2.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.885Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/hero/hero-img-2.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 142460\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":142460,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 350x600, components 3","md5":"90b948945ee7a4fec9c30343ca95f019","sha1":"f95143740991349816225ba5afccbd5232f8ac8d","sha256":"5f531109f4933e8b3156823d17b99a177fb75de338e44f7c03035902c97a510f","sha512":"ce42794246995ceca531329c2ac2b993799f69b0acf205f84a721fd4c3811d7b9e77b2a77e503a61980756493c8018376325f29e8b9f1e92a944b281bbd840fc","ssdeep":"3072:6GljmlEjc289s4Qzg7WL/uvKQVlK8X+OSCxW0JlDw5WRV:3slQtl4ugKLmlvpSH5WRV","tlshash":"6fd312337e37e19d9884ba67c8a753f9b32a7734e6ea0946d02c0db4d94f12b5b14806","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.061911Z","times_seen":1315,"resource_available":false,"data":null}},"time_used":132,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/shape-3.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.901Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/shape-3.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1124\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1124,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 55, 8-bit colormap, non-interlaced","md5":"8cee0389372162c0a2352b2613c13570","sha1":"57a2a9b090d7b09bb3dee3290e1007ec71b4e663","sha256":"f731de19b6012dff0f19cfbda37e62c01c40e8e29280203a92d4a2f0643229a4","sha512":"dc4891e78970e3e68a4cbdbb1bef3028f16f8b8796a352042c49805dda59a9cb8247ccaa8c018daebfbecd8367fad0c62adebd077b209b21f6f21aa6f6e90fce","ssdeep":"","tlshash":"d421128a5f39de3950ecc6688314c513499cb1bfe38a309baa424685f67040d00d6b83","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.090385Z","times_seen":1367,"resource_available":false,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":148,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/jquery.appear.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.031Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/js/jquery.appear.js HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 497\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1198,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (1198), with no line terminators","md5":"80d1c754b36f693ea7de8d608acc4afe","sha1":"10736302703a32d7682359a36226f341c8982daf","sha256":"b57506318dccce1f06d2545f2db1bead5d46acb07df071aee7651d2c3013105d","sha512":"53f2b2c87a37679c54ae6e4adec6ab5e38aba31bf9ad51c69ada851d85d3b6e9d5cb3a770986d2584203d4f55fe6f03acbc0314afd99d536d70fb020847d68c2","ssdeep":"","tlshash":"0e21a8ca38c6bce583fb311c562f72421161913f574299a31ceadd7c35a6c913c13e68","first_seen":"2023-03-07T17:48:49Z","last_seen":"2026-07-26T06:29:09.043151Z","times_seen":1580,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"translate.google.com/gen204?sl=en\u0026nca=te_ap\u0026client=te\u0026logld=vTE_20260120","fqdn":"translate.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.250.74.142","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:51.235Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:51:06 GMT","end":"Mon, 23 Mar 2026 19:51:05 GMT"},"fingerprint":{"sha1":"A8:07:E4:29:1F:DC:18:F7:9D:4E:B4:B1:E3:DE:8B:8E:C7:50:9F:F4","sha256":"D1:3C:D1:40:94:0C:B9:C2:51:D7:CA:E9:9A:B6:25:51:0F:E5:17:F1:6F:FF:2E:58:C6:FA:6A:72:54:B1:96:46"}}},"request":{"raw":"GET /gen204?sl=en\u0026nca=te_ap\u0026client=te\u0026logld=vTE_20260120 HTTP/1.1\r\nHost: translate.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\ncontent-type: image/gif; charset=utf-8\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: Mon, 01 Jan 1990 00:00:00 GMT\r\ndate: Mon, 26 Jan 2026 10:59:51 GMT\r\ncross-origin-resource-policy: cross-origin\r\np3p: CP=\"This is not a P3P policy! See g.co/p3phelp for more info.\"\r\naccept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version\r\ncross-origin-opener-policy: same-origin\r\npermissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*\r\ncontent-security-policy: script-src 'nonce-UQaxKjE-ivOlRSHu3srKtQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/TranslateApiHttp/cspreport;worker-src 'self', require-trusted-types-for 'script';report-uri /_/TranslateApiHttp/cspreport\r\nreporting-endpoints: default=\"/_/TranslateApiHttp/web-reports?context=eJzj4tDikmLw05BiEOLmWD7p7mk2gRnrL1QoKSXlF8aXFCXmFecklqQWpxaVpRbFGxkYmRkYGhnqGZjHFxgAAAxXEmc\"\r\nserver: ESF\r\ncontent-length: 0\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nset-cookie: __Secure-ENID=31.SE=JcD1fF88kr55RS5l6Cpm1SXO3v0Psl648ilgmF3JKBNkSLi_QDnEhMTwvo_DdYylt-yWKcdL6gDk5Ikg7tWJVW0HE1k7hbOKKZlIWFZ4phhokEXjDfIuK6ynQkJzsdPhmFQZcmLLubtzunXW51N9Fzl_o81rbIPssj5pLIBSmB6ASdQmcPhHvyMx0jHVZdsl56UBCpO5i0brsYsd4QT5X_MamXeFelvPq9IvJGOq2pi27GBdGsE6IY4; expires=Fri, 26-Feb-2027 03:18:09 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"image/gif; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T07:24:10.984473Z","times_seen":17541736,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/jquery.min.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.978Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/js/jquery.min.js HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 30268\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":89503,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65446), with CRLF line terminators","md5":"0732e3eabbf8aa7ce7f69eedbd07dfdd","sha1":"4cd5ddc413b3024d7b56331c0d0d0b2bd933f27f","sha256":"ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b","sha512":"41d24c426abcf913be59917591d906318a547661280036b098a2b1b948bcf9ff14f268b140db10956730d64a857a61b81034d888ed7f857419dee6b8d327447c","ssdeep":"1536:ejExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1vE:eIh8GgP3hujzwbhd3XvSiDQ47GKq","tlshash":"e19309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","first_seen":"2023-03-07T01:10:32Z","last_seen":"2026-07-26T07:38:01.582346Z","times_seen":21311,"resource_available":true,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":123,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap%404.0.0/dist/js/bootstrap.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/bootstrap%404.0.0/dist/js/bootstrap.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://northwesternunion.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 400 Bad Request\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=86400, s-maxage=86400\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/plain; charset=utf-8\r\netag: W/\"3e-rVTZaEP/IducDerMLIXX9cqTIf0\"\r\naccept-ranges: bytes\r\ndate: Mon, 26 Jan 2026 10:59:50 GMT\r\nage: 47294\r\nx-served-by: cache-fra-eddf8230194-FRA, cache-hel1410023-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 62\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T07:24:10.984473Z","times_seen":17541736,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/hero/hero-shape-4.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.880Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/hero/hero-shape-4.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 2828\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2828,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 61 x 41, 8-bit/color RGBA, non-interlaced","md5":"c6fa237e3615874a95f25dbe241465e4","sha1":"a8e42d5c5453d27fbca195ce866df66ad677babc","sha256":"e72300940f13f799954928f3ef73bebbe4c59f1664cd703adac82e3a99e7bfbc","sha512":"be45a8d14ffaca88309cb06e7460a61dd745be4bd1be3de782307c615c075c5521ad46968a135838f8e6d499611fa07d98064362245942fc556ac598c32ba4d3","ssdeep":"","tlshash":"fc512bb1f4d2e7fdc0ee3a018a7c205e646b32e3640637c0ae91120efbd79646649881","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.030385Z","times_seen":1345,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/partner/partner-5.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.894Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/partner/partner-5.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 2656\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2656,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 130 x 35, 8-bit/color RGBA, non-interlaced","md5":"61c77cb7361420123fab4e5ff696e405","sha1":"613d84c29ddcc17fe9e28a4b5686b4085cd3dd37","sha256":"a3f892da036b38fee09c448d981a4cddaabff59cbd9b696ef00c93251823c596","sha512":"aaf68e8753df896f7fa70033e5ef62c4fdb1c7f71c9eb18ebfef2d489a01af0b994146dfec11dadeb3d0f600abe75412f20f677be44dbf3a308f9616d67353d1","ssdeep":"","tlshash":"ef514d452da30859e1f3a25d3d28203b9df6282e4093ce61b1973c667b505a3f0ab556","first_seen":"2023-11-12T08:26:57Z","last_seen":"2026-07-26T06:29:09.078399Z","times_seen":1307,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":131,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/flag/newzland.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.918Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/flag/newzland.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 1040\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1040,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit colormap, non-interlaced","md5":"9bbf5eedca3d147d0cf857312515c461","sha1":"1ba9ff83d4174b87d2703262df63834f4bb3c197","sha256":"0587301dd2fdd00f161a1a6b8d420bff27b5fc47b1f74b2ee07cdff24141347a","sha512":"28e65e6d2ba05247b5d9942b140e16429677aea34a2cbd025503b43009d504f051446ac1eb628e76f0e797e07dfb528b125fdb377cb75d2c961c568ab33877ec","ssdeep":"","tlshash":"7511b50e70845588c225030603d4503a0e339dba7db07b4ebc0f6c1dd640f5619e1f0b","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.087458Z","times_seen":1336,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/bootstrap.bundle.min.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/js/bootstrap.bundle.min.js HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 22162\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":78085,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65294), with CRLF line terminators","md5":"52a78545b39d3c5ceeabbac8cbe46cc0","sha1":"99e4421a2f4de040de5905bc15cd45d291ded586","sha256":"120666e01d671db172cecd87aaaed5cb0feb2da24d971c291fe1b8e0f64b18ac","sha512":"22cde83ff9ed88611b9307db3ec6604683d958c3d8caf879220f60146ff760d60dd5769cc5accb9655e269c21c2829fab47ad0d57963714ad435a3c4db28fc59","ssdeep":"1536:P+pbTNR2t4NEdiK5J2w8gGzjJVPOW7tI+r9ixR2nwZ7:u36WJr9ixF","tlshash":"3273c5493254b8730ade45a68037470bf3265994b14b802cb5bcadde2a3dd8672b7f7c","first_seen":"2023-03-08T09:18:43Z","last_seen":"2026-07-26T06:29:09.084565Z","times_seen":2837,"resource_available":true,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":120,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"translate.googleapis.com/element/log?format=json\u0026hasfast=true\u0026authuser=0","fqdn":"translate.googleapis.com","domain":"translate.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.138","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://northwesternunion.com/","date":"2026-01-26T11:00:01.100Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:24 GMT","end":"Mon, 23 Mar 2026 19:52:23 GMT"},"fingerprint":{"sha1":"43:39:AF:0A:74:F9:2F:1B:C0:1E:4E:89:21:30:C2:28:EC:9F:6C:67","sha256":"EA:F1:0E:C7:36:18:F3:9D:D1:D5:34:23:44:7D:6F:9D:2F:61:C7:81:09:9E:E9:C8:02:C8:F2:2C:0A:83:B3:A5"}}},"request":{"raw":"POST /element/log?format=json\u0026hasfast=true\u0026authuser=0 HTTP/1.1\r\nHost: translate.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://northwesternunion.com/\r\nX-Goog-AuthUser: 0\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 1168\r\nOrigin: https://northwesternunion.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1168,"data":"[[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,\"zxx\",null,\"TE_20260120\",null,null,[4,0]]],1871,[[\"1769425191069\",null,null,null,null,null,null,\"[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,\\\"no\\\",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,[1,\\\"te\\\",\\\"5D45DAA4-1408-4BBA-A5D3-911685802D0C\\\",[\\\"https://northwesternunion.com\\\",null,[\\\"\\\",[],[],null,null,[\\\"navigation\\\",\\\"h2\\\",[],[],[],[],[null,11000000],[null,13000000],[null,13000000],[null,66000000],[null,39000000],null,[null,142000000],[null,143000000],8283,6939,36806]],[\\\"translate:page_load_to_initialized\\\",[null,143000000],[1,446000000],null,[]]]]]\",null,null,1,null,null,null,0,null,null,null,null,null,1]],\"1769425201070\"]"}},"response":{"raw":"HTTP/3 200 OK\r\naccess-control-allow-origin: https://northwesternunion.com\r\ncross-origin-resource-policy: cross-origin\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: X-Playlog-Web\r\ncontent-type: text/plain; charset=UTF-8\r\ncontent-encoding: gzip\r\ndate: Mon, 26 Jan 2026 11:00:01 GMT\r\nserver: Playlog\r\ncontent-length: 131\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":131,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"JSON text data","md5":"ca0b7e866005f6774d284b9f438ebfd2","sha1":"53644f5ee3640189bdb223473ba6a2d46606c556","sha256":"502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358","sha512":"939c4526c623db033ad40bfdc6c8848a1dcd0ca797f17fbbd89fbec1b49dededc16e89084b3759e62fa0ffc8fe896980b10a1ff8daee22736a70b08f1ee13e2f","ssdeep":"","tlshash":"58c08c50330469e1080e82c8c0026858228c903b46708cf10bbd68125d3234a1004854","first_seen":"2023-04-05T03:14:56Z","last_seen":"2026-07-26T07:18:37.483386Z","times_seen":581372,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/testimonials/client-2.jpg","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.883Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/testimonials/client-2.jpg HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 24322\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":24322,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 200x200, components 3","md5":"4492070c33a5a620c7f74f67f13ccec5","sha1":"eabfa0faaf8877499c8681aab77236dddbe948ac","sha256":"079d830b47f34df1cbfc52ad478b4ff995e0c28b20925a877c3f09f91ca8c797","sha512":"2b84b864b1bad11c6937c1fce97ec6b0c10df32cc9952a2bd5b174ab86f9fabcf09811574d1b396a682159969e68a595fd5ba625ef99beaf64e2b8bc0de4b051","ssdeep":"384:LeOMbPiVLUNSNs6C9RiTsqW/ioVwVUFtGBbzrEzKg7JIMr2hKOdCXff:XMbPiVLUNS49RUsqGiNGFUBbzKTGO2hs","tlshash":"9eb2e1572f838c8f6a3a4b3ce61e82a36911033d9523e79c2d6935c2d72b3fda45c854","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.0717Z","times_seen":1369,"resource_available":false,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":64,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/img/flag/france.png","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:49.925Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/img/flag/france.png HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Mon, 02 Feb 2026 10:59:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-length: 704\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":704,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit colormap, non-interlaced","md5":"9b5b3d7931b3029b5d87f478c3879a21","sha1":"e31575340bbc26635b43c3e4b48e1efb379c494f","sha256":"d0af89d9567368a223db1b6345148d40e272a3de4c2d6c378c6301ec10864328","sha512":"375b8a5b5eafc62eb88ece2cd5c38d6dc35aabcb1e7adf3a98975c1855b3b7138729716d1aa666e83fe471bb417a38ce384e0484941d085b0ab014770c583412","ssdeep":"","tlshash":"bb01449ee1045851ca15c44e1b9ae861ee1a595fc9b4d0b93c43c41cd403b7c18d1743","first_seen":"2023-05-19T22:55:22Z","last_seen":"2026-07-26T06:29:09.091139Z","times_seen":1332,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"northwesternunion.com/temp/custom/assets/js/fancybox.js","fqdn":"northwesternunion.com","domain":"northwesternunion.com","tld":"com"},"ip":{"addr":"161.97.121.66","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.031Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"northwesternunion.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 19 Jan 2026 00:34:07 GMT","end":"Sun, 19 Apr 2026 00:34:06 GMT"},"fingerprint":{"sha1":"5D:86:06:D5:6A:97:D3:D8:13:57:FA:E9:77:AE:C2:2B:7B:7F:AC:31","sha256":"60:09:8F:C8:28:2B:54:D1:A4:0A:79:7F:EF:74:24:26:B2:C8:DB:72:79:0C:BC:50:02:94:31:04:1C:F8:22:98"}}},"request":{"raw":"GET /temp/custom/assets/js/fancybox.js HTTP/1.1\r\nHost: northwesternunion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nCookie: XSRF-TOKEN=eyJpdiI6IlVmdHBWOEVaL0dMTVRjT0dXUzcvZ1E9PSIsInZhbHVlIjoiT0Z1Wkp1M0VzSnNqY2tUTG82eFZhSHE3dmR5dEEwSmNhb2NhMjhyczZacE9vM3doSTVlRGc0OW1iOGNzRzl6YVB6TFZweHBwYXZKSXc1TjhGYk1Yby9VWkNjL2FhVXBZM0V1MnpoUGphY1RYSUxRU2h3L2NJdFpYMloxMHczVSsiLCJtYWMiOiJlZDExYTM1YTI3YjZkMzkyNTQyZmNkZWQxNzk1YzdlZTIyYmQ0YWE2YjFiN2EyMzVhMTJlNTE5NTUzNzY3NWJmIiwidGFnIjoiIn0%3D; vereintemaestroonline_session=eyJpdiI6ImtxYmFkc3J1bEtzZGVGV01BajVET0E9PSIsInZhbHVlIjoiNHRYNVBUTUsrNzc3Q1g0bWpIRHVRNEdaV3dxQkJaQnUzQVJWSWs0YWNBR1RRK09sbmE4c1VOU2pLMmYwUm5SbTlUQVJQc1oxcWFvdkVIYk1TZThEaXUyMFJJYk5XSXJlUzdNcUdSWFhIaERKdzIveUJXdmZKZ0RXMnJuM2RXcjQiLCJtYWMiOiJmNWRjYjBhMmRlOThhOTAyNDc2YmU0YzhjYzliZGM4ZGE3ZGYzNGY0ZmM5MjdhMjRmMmFjZDg2MmM3NjVkNTgwIiwidGFnIjoiIn0%3D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/javascript\r\nlast-modified: Thu, 24 Aug 2023 19:09:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 20810\r\ndate: Mon, 26 Jan 2026 10:59:49 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":68446,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"5903cd4e4bdc6c28ece32e469b887a8a","sha1":"825baf2b74a47eccb7b3f439fe58da710b84a2c4","sha256":"c563abe9b3e16a2461415597e352e306678e093e2078d6f3b9618d902b1ad2c7","sha512":"9562ef7d089c8ebd39a3978cdac3266643a4a184ebb122598b9991b8c9dbbcd61e4aae736bc2e1a84ce6edd97d6f671fb366ebc802b9a8170cc82d510ffbd3b9","ssdeep":"1536:FUtGulsqqQzeFuouppK0WFVnsQrNz7M4HJ3t5oSKN1fQq58cTJ7PBTf:cGasqqQzeFuoubK0WrNz7M4pd8qq58cH","tlshash":"0663f89fb610702582bb0594a30f560ed1377116f10284fa78bcd4d55ae4fc922ebbfa","first_seen":"2023-03-09T06:26:16Z","last_seen":"2026-07-26T06:29:09.035019Z","times_seen":1567,"resource_available":true,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"northwesternunion.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.html","fqdn":"cdn-cgi","domain":"cdn-cgi","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://northwesternunion.com/","date":"2026-01-26T10:59:50.445Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /scripts/5c5dd728/cloudflare-static/email-decode.min.html HTTP/1.1\r\nHost: cdn-cgi\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://northwesternunion.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T07:24:10.984473Z","times_seen":17541736,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}