{"report_id":"0cac5424-2cd5-4c04-be3f-a47668aba927","version":0,"status":"done","tags":[],"date":"2026-07-22T19:28:35Z","url":{"schema":"http","addr":"212.212.104.25/","fqdn":"212.212.104.25","domain":"212.212.104.25","tld":""},"ip":{"addr":"212.212.104.25","port":0,"asn":3257,"as":"GTT Communications Inc.","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"http","addr":"212.212.104.25/","fqdn":"212.212.104.25","domain":"212.212.104.25","tld":""},"title":"LK21 - Nonton Film TV Series LK21 Layarkaca21 Rebahin LK21 - 212.212.104.25","dom":{"size":230384,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (6002)","md5":"a89dd9a9746d6e7f997dadbc7d153700","sha1":"634cc28ca583a826e61870baf090e743d8b351f9","sha256":"1e01f72329581e09757ecd5b4db261379a8b4a0f2c47b3f4c174b59d1ce6fc3e","sha512":"398ffef7ce5c80dbd556465901b23551e03964549620f7fa2a12a37ba8ee68f7c53e0b2e4cbb0e209941dafd84af103f19cb6f7ec81a3ddfb72c92cb8aaafbef","ssdeep":"3072:mbKmAAQCvnXLrQfoXRiYD+zUr6pMkv+zt9PasDgrpfO10iR:kKVAzTrQfoXRivWP/DFR","tlshash":"be34e8b9d4682d3a0ed6fea2f2947b15f1910552cfa15823b7f8df1a77c0d80a5b2309","dom_hash":"domhashd017b74735f8e178ae82c32b0ac5d41b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"212.212.104.25/","fqdn":"212.212.104.25","domain":"212.212.104.25","tld":""},"ip":{"addr":"212.212.104.25","port":0,"asn":3257,"as":"GTT Communications Inc.","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-26T19:28:35Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":13}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"asset.semuadisini.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"furiousexpansion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"workdeadlinededicate.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"workdeadlinededicate.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"smallestpawsmention.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"cursor.railway.cam","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"cursor.railway.cam","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ssp.semuadisini.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"portalfluently.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"cdn2.tapioni.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"ipv4.icanhazip.com","ip":{"addr":"104.16.185.241","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-07-31","domain_rank":65266,"first_seen":"2013-10-09T05:58:12Z","last_seen":"2026-07-22T09:21:17.527248Z","alert_count":0,"request_count":3,"received_data":1883,"sent_data":1422,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]},{"fqdn":"luugy.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2022-04-19","domain_rank":0,"first_seen":"2025-08-22T01:04:36.570058Z","last_seen":"2026-07-17T14:41:42.941499Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":651,"comment":"","tags":null,"fingerprints":null},{"fqdn":"212.212.104.25","ip":{"addr":"212.212.104.25","port":80,"asn":3257,"as":"GTT Communications Inc.","country":"United Kingdom","country_code":"GB"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":204839,"sent_data":399,"comment":"","tags":null,"fingerprints":[{"name":"Redis","description":"Redis is an in-memory data structure project implementing a distributed, in-memory key–value database with optional durability. Redis supports different kinds of abstract data structures, such as strings, lists, maps, sets, sorted sets, HyperLogLogs, bitmaps, streams, and spatial indexes.","website":"https://redis.io","common_platform_enumeration":"cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*","icon":"Redis.svg","categories":["Databases"]},{"name":"Redis Object Cache","description":"","website":"https://wprediscache.com","common_platform_enumeration":"","icon":"RedisObjectCache.svg","categories":["Caching"]},{"name":"WP Fastest Cache","description":"WP Fastest Cache is one of a number of plugins for WordPress designed to accelerate the performance of your website.","website":"https://www.wpfastestcache.com","common_platform_enumeration":"","icon":"WP Fastest Cache.png","categories":["WordPress plugins","Performance"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"static.nresystems.com","ip":{"addr":"104.18.19.137","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2001-02-22","domain_rank":0,"first_seen":"2026-05-13T20:38:27.678612Z","last_seen":"2026-07-22T03:24:13.038865Z","alert_count":0,"request_count":1,"received_data":1203,"sent_data":633,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"interlinecustomroofingllc.com","ip":{"addr":"172.67.147.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-03-26","domain_rank":0,"first_seen":"2026-06-17T16:45:27.02165Z","last_seen":"2026-07-10T16:56:42.613488Z","alert_count":0,"request_count":1,"received_data":1232,"sent_data":609,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]},{"fqdn":"furiousexpansion.com","ip":{"addr":"172.240.127.244","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2026-02-25","domain_rank":0,"first_seen":"2026-03-13T10:11:44.490063Z","last_seen":"2026-07-16T11:42:38.408747Z","alert_count":6,"request_count":6,"received_data":51339,"sent_data":8199,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"smallestpawsmention.com","ip":{"addr":"172.240.108.68","port":80,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2025-04-12","domain_rank":0,"first_seen":"2025-10-25T11:16:53.987561Z","last_seen":"2026-07-05T01:26:08.871844Z","alert_count":1,"request_count":1,"received_data":49148,"sent_data":375,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"portalfluently.com","ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"domain_registered":"2026-06-18","domain_rank":0,"first_seen":"2026-06-19T16:11:46.270184Z","last_seen":"2026-07-17T22:52:31.697672Z","alert_count":1,"request_count":1,"received_data":85885,"sent_data":453,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cdn2.tapioni.com","ip":{"addr":"172.66.163.179","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2021-05-27","domain_rank":0,"first_seen":"2026-07-03T08:30:00.51805Z","last_seen":"2026-07-20T08:41:58.064501Z","alert_count":1,"request_count":1,"received_data":2312,"sent_data":453,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.storageimagedisplay.com","ip":{"addr":"45.133.44.2","port":80,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"domain_registered":"2024-09-13","domain_rank":170153,"first_seen":"2024-09-13T12:56:32Z","last_seen":"2026-07-17T07:25:49.152824Z","alert_count":0,"request_count":4,"received_data":377408,"sent_data":1944,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"flushpersist.com","ip":{"addr":"172.240.127.234","port":80,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2025-07-01","domain_rank":23810,"first_seen":"2025-07-08T10:43:12.76905Z","last_seen":"2026-07-17T07:16:14.790139Z","alert_count":3,"request_count":1,"received_data":454,"sent_data":751,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"ipsadminuser.shop","ip":{"addr":"172.67.205.92","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-05-23T17:38:22.948125Z","last_seen":"2026-07-14T10:46:18.627149Z","alert_count":0,"request_count":3,"received_data":3103,"sent_data":1707,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"ssp.semuadisini.xyz","ip":{"addr":"37.27.230.125","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Finland","country_code":"FI"},"domain_registered":"2024-11-05","domain_rank":0,"first_seen":"2026-07-22T19:28:38.831251Z","last_seen":"2026-07-22T19:28:38.831251Z","alert_count":2,"request_count":2,"received_data":187847,"sent_data":963,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.250.178.104","port":80,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2026-07-19T22:31:15.74052Z","alert_count":0,"request_count":2,"received_data":512567,"sent_data":801,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"workdeadlinededicate.com","ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"domain_registered":"2024-09-03","domain_rank":0,"first_seen":"2025-11-13T08:41:33.674059Z","last_seen":"2026-07-15T20:25:22.47251Z","alert_count":2,"request_count":1,"received_data":956,"sent_data":567,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"tagivi.com","ip":{"addr":"172.67.208.243","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-11-10","domain_rank":0,"first_seen":"2026-06-06T09:24:46.497737Z","last_seen":"2026-07-16T09:24:16.311495Z","alert_count":0,"request_count":4,"received_data":81543,"sent_data":2757,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cursor.railway.cam","ip":{"addr":"130.94.30.48","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"domain_registered":"2026-05-30","domain_rank":0,"first_seen":"2026-07-22T19:28:38.317989Z","last_seen":"2026-07-22T19:28:38.317989Z","alert_count":6,"request_count":3,"received_data":52995,"sent_data":1503,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"backupdata.b-cdn.net","ip":{"addr":"138.199.46.65","port":443,"asn":60068,"as":"Datacamp Limited","country":"Singapore","country_code":"SG"},"domain_registered":"2016-04-25","domain_rank":5523778,"first_seen":"2025-04-16T03:23:52.991243Z","last_seen":"2026-07-05T01:26:07.834848Z","alert_count":0,"request_count":6,"received_data":888032,"sent_data":2834,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]},{"fqdn":"asset.semuadisini.xyz","ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2024-11-05","domain_rank":4236886,"first_seen":"2025-07-20T06:56:43.923237Z","last_seen":"2026-07-05T01:26:07.515757Z","alert_count":9,"request_count":9,"received_data":324568,"sent_data":3706,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"llvpn.com","ip":{"addr":"104.21.13.59","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-03-24","domain_rank":0,"first_seen":"2025-07-24T23:05:45.337747Z","last_seen":"2026-07-19T22:48:53.030316Z","alert_count":0,"request_count":1,"received_data":90320,"sent_data":329,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"www.google.no","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2001-02-26","domain_rank":92680,"first_seen":"2012-06-26T23:22:08Z","last_seen":"2026-07-19T23:30:29.224351Z","alert_count":0,"request_count":1,"received_data":578,"sent_data":828,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cursor.railway.cam/qqtime/qqtime.html","fqdn":"cursor.railway.cam","domain":"railway.cam","tld":"cam"},"ip":{"addr":"130.94.30.48","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"471a8208af8e355aa71e5635b2810f36","sha1":"97d6512862904902aabd3bcd3a3e4ba2ebc1ca30","sha256":"6b96c050c129fcee4fc3fed1a45de3f66a1090914550b3665b419a3cd1aab39d","sha512":"7b69dac20fc9a36dad5a3aaa336284b1e469d89d9a31bab9009f90ee6794cd6b65d86bd4f4cf19ff2542ccc3a9ca48f59489259f40ffac2ed733683533a839b4","ssdeep":"384:84iG/FZpJgY/ZQpplmAsZzcjWLyjbUJTT:84iiZlZzcjJbQTT","tlshash":"c042c89b33c9c4accf29dc4f59571c93d5de9367229dc0e2eb835c89ec2a6198174b88","size":12501,"data":"","first_seen":"2026-03-04T10:06:21.804012Z","last_seen":"2026-07-22T19:28:44.642947Z","times_seen":98,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"portalfluently.com/sfp.js","fqdn":"portalfluently.com","domain":"portalfluently.com","tld":"com"},"ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","size":85379,"data":"","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-07-22T20:52:10.83211Z","times_seen":23576,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"asset.semuadisini.xyz/wp-content/cache/wpfc-minified/kxyq1c0q/4e5ln.js","fqdn":"asset.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"dbda7ff041ae2d7b54f49fcf552c3d00","sha1":"7d6db9646c4659d5ecceaed3a75a97d5c35aae80","sha256":"1abb63db89fb7f6da277ac6d6a56cc3549ec33bf1b8bc923b593f64090909b00","sha512":"f462d728991a81cd14963ac67efd7d19f769ddc42f4c08392d66987394172850c012ef792f8d7bc7756492f89f19b093665f3747a1cfcd31003dfd2aadced9de","ssdeep":"1536:nRUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKhrP7QK:fHNwcv9VBQpLl88SMBQ47GKhrPU+B","tlshash":"25a308df769ab4224bb730b9507f510bb276099d680d4400f199d8eabc7c94a823bf7d","size":101300,"data":"","first_seen":"2025-04-16T03:23:59.357407Z","last_seen":"2026-07-22T19:28:44.619859Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"212.212.104.25/","fqdn":"212.212.104.25","domain":"212.212.104.25","tld":""},"ip":{"addr":"212.212.104.25","port":80,"asn":3257,"as":"GTT Communications Inc.","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"8c2479f0fb146cd7df94e00c96e000c3","sha1":"35495b1a41dbb4e3276842b1c6693c7135be4a13","sha256":"c435bf3ccc8924214385ee8a02502f788875d6925048003da79f82b4177d99cd","sha512":"8666151b74ecbd847e3643c5b7f667041303732a0b2596d1b0a902faf177ee3ffab45cfab505c8868f9005a75bb12096b9b6bb04551cecbf47f39159e49fcb94","ssdeep":"","tlshash":"8ae0abac2c92b0a733fc7a39d2378f6a2365078035839524ca56cc2524618c75c9ae8e","size":437,"data":"","first_seen":"2026-07-22T19:28:44.643482Z","last_seen":"2026-07-22T19:28:44.643482Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"212.212.104.25/","fqdn":"212.212.104.25","domain":"212.212.104.25","tld":""},"ip":{"addr":"212.212.104.25","port":80,"asn":3257,"as":"GTT Communications Inc.","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"345dfc761889197d0c5e67ad4468eab1","sha1":"69e1b0c101bd4d6ba3e57c6ca706ad57a6741858","sha256":"b170ec221654bab81b51b7da869ca34aaa98a52109a5c1ae9731b36a307ca413","sha512":"6f8d982d9ba8357f4bf5c54b3587941e0a1857ad65c7170d20d7752a5e30ee89e9e0a606eafb00a40c0815b1408e5d06e06eba849498b0097418bb19c5f96316","ssdeep":"","tlshash":"85e0ab2998e706384cf67a481038ca7930fc38a0aaa3d057525cc87ccd39fc50c00aec","size":424,"data":"","first_seen":"2025-04-16T03:23:59.371623Z","last_seen":"2026-07-22T19:28:44.644404Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"212.212.104.25/","fqdn":"212.212.104.25","domain":"212.212.104.25","tld":""},"ip":{"addr":"212.212.104.25","port":80,"asn":3257,"as":"GTT Communications Inc.","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"aa40b6c37d8c42c20ad6f6ec62cfc103","sha1":"31dc5e9b3a31abdad03e38d926122a7b894e904c","sha256":"2a37fadfe6201fff4377f41677fff5dec825e154d91c4ac94f4b5532a4b3cc32","sha512":"fc7f0bebf6aaa0b40643fd1401e3fb8e3d713619ba619e34fbd8c72527ebbdc1df2ec388c4f3ca1680a5165238f4bae015a29a42e3d3f3086c8f0facded55df1","ssdeep":"","tlshash":"4bd02bacb9357431857af265a40f73dc7f6d60552593540a2c1c84d4ecd4dfe34d282e","size":282,"data":"","first_seen":"2026-07-22T19:28:44.645303Z","last_seen":"2026-07-22T19:28:44.645303Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"212.212.104.25/","fqdn":"212.212.104.25","domain":"212.212.104.25","tld":""},"ip":{"addr":"212.212.104.25","port":80,"asn":3257,"as":"GTT Communications Inc.","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"1894dbbd41b6cc5db5d6c5427035134b","sha1":"bbe20200df777613a4ef28cf57a326e1edc88110","sha256":"e523988a961b852abe6d849942b85bad3e263641b5f9bc9f344e382b7b0ef736","sha512":"82a921dfd5b06d078bc46d8f1fe4898adaaaa0dd4b22136bb71b6d0547c1df5e2a63f66f9f4036605cc860ae97b7383402b5b024e81b0c25faa2204e15b48d13","ssdeep":"","tlshash":"17c09bdc318b5db155eb2b410b7fb714b151325094915c31091573449532c577b54874","size":142,"data":"","first_seen":"2026-07-05T01:26:15.310451Z","last_seen":"2026-07-22T19:28:44.64625Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"212.212.104.25/","fqdn":"212.212.104.25","domain":"212.212.104.25","tld":""},"ip":{"addr":"212.212.104.25","port":80,"asn":3257,"as":"GTT Communications Inc.","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"31ed2953a2fd6c8cd033f671ca06fc31","sha1":"4922c88416c812500b1f046365b44780882f8926","sha256":"e2ab050ef3166182a7dced5270b137be7fda1710226332ea5206e0f13136116e","sha512":"c793bfb083ddb677db0435be02c136879c42968ccbcc3fbf774273beb9ed27a3a9170a8e8b8a080592dd0c488214e3163abca87b5d78006121daae3e578ced81","ssdeep":"","tlshash":"8fc0c0b860f8d430004800c830bbc3647c70305032a27080c48d7c1cfd38fc32452cb4","size":187,"data":"","first_seen":"2026-07-22T19:28:44.647026Z","last_seen":"2026-07-22T19:28:44.647026Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"asset.semuadisini.xyz/wp-content/themes/muvipro/js/js-plugin-min.js?ver=2.1.9","fqdn":"asset.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"3b56b9e4e536ef21f9bf645591bc288d","sha1":"6579714f0a6e2c16ddb4029ebf584e0755afe63d","sha256":"0812f1ec045cff5fcc841c5ae347cb299f3dbeed4141c9d21bc6a37f63623eae","sha512":"3f429b6565a4a1b5fda9517a7a56df27c90915c46fd27e9329dbc8ccd7da11ab3cff2d2e66f24c321b15586eac2de790814501b7537c815f197280ef4bfd956b","ssdeep":"768:7GllxCCMHzcEO4xIbsyNMH0JXm35lW2E9nUbTJuyynhdHbt3:SLQlHK9NMH0O5l+RUJuyQnt3","tlshash":"751309d97251313282e721e6129f420e72375828ed078948b439ede83dbd96d326fe7d","size":43749,"data":"","first_seen":"2023-03-07T01:19:38Z","last_seen":"2026-07-22T19:28:44.618146Z","times_seen":418,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"smallestpawsmention.com/2792cc3d21affd98feaab0ce1a771b7b/invoke.js","fqdn":"smallestpawsmention.com","domain":"smallestpawsmention.com","tld":"com"},"ip":{"addr":"172.240.108.68","port":80,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c1ee40cd3e80bb4c9b5e740c0c821344","sha1":"35aa9718f1b643e6459ae7e105880f5c3c4f1898","sha256":"c592bc2e429359e226a0859b59c403df3a3c2661838136d90ad07749877ba635","sha512":"6c9b85721ded54a0463fffe7217fdfb32366756ab1e8ffeb41afe7d6294150319c5b864cf95df1074356e7b358ead725f69a14ac29f5b59ad029541c14302036","ssdeep":"768:uLB+fWzKIfKdVSvou674jfwpnzYJEOlhPgul4wlA:KB+f+CdIvh6sCnfvwA","tlshash":"cc23a88c7f91f16c16576073253f910af1294e62e4a89688d263f07c1a6c33dda7ebd8","size":48347,"data":"","first_seen":"2026-07-22T19:28:44.623514Z","last_seen":"2026-07-22T19:28:44.623514Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.googletagmanager.com/gtag/js?id=G-KC8CB439VM","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":80,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e3db4d0446f7e234db67b0409ec9dbbe","sha1":"f9a0fe05bed8429aec80d6791201c0fcb6ce4b00","sha256":"74e5e645fbeced364d93967ea0b46ea72cd3e2749dcbbddcd7f6af899f846691","sha512":"974593658e7018ea02c250a4cc926ddb0a4fca5ac7cb10279c5fb453fd32f8170c46bc3233f2df3777c3fd985477f747679eb89ab8afb952942734c52046d907","ssdeep":"6144:/P72yc1/T/I0t9RlGYYwqY5T+cMz9d0C3TnHfbcx+OfxPmX2e:n7OTxMjbcFZOp","tlshash":"23b40aceb3d674225396f478503f01cba97b29e2b49cc89ab189cce02e745568177f78","size":511682,"data":"","first_seen":"2026-07-22T19:28:44.638657Z","last_seen":"2026-07-22T19:28:44.638657Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cursor.railway.cam/qqtime/qqtime.html","fqdn":"cursor.railway.cam","domain":"railway.cam","tld":"cam"},"ip":{"addr":"130.94.30.48","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"d8751da6f857e6ba355528fc47187a07","sha1":"3c271c8059271e5ff1f48ed0127f280a5919a297","sha256":"6b8653bec2fd37750a66db832eaa9d0529baa960a72ff250a0490236b33d2ee2","sha512":"ce4a65a31a2c238904607861bdcafaf5e18d52a99474a58fc83f19e45d7b867b1d86777a1570c7e70b10c208c925f8959413fe94fb936f0dc9e64f31d955bf0c","ssdeep":"768:I4JJt5z11OWLwAxsCpcOiRJ/wNvobSvJwh2xNH7ZMQlYN:I4JJt5z11OWLwAxsCWB/wNv7i476N","tlshash":"5ad24d3b53c321e2776d76a33742aa4603160dc6e8e3468548e705d99b25a1f0fed78d","size":29951,"data":"","first_seen":"2026-03-04T10:06:21.802937Z","last_seen":"2026-07-22T19:28:44.647872Z","times_seen":99,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"asset.semuadisini.xyz/wp-content/themes/muvipro/js/customscript.js?ver=2.1.9","fqdn":"asset.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"b246ea22dea584dd0bdf855515f3b701","sha1":"55767474c10d08255b1876f70f4e758985aecbef","sha256":"1c6f518eeb52ac428e414991cc7536284312c34763cb9e385271e63c48cddaab","sha512":"7aaed7a85748719cc39a2711216fc9245290110c700fb01e4233856f4fd3591ce28a7da5d36408278a49b4d4cb8203242ed33ac1089dc92f4f25b30916247745","ssdeep":"96:p4lr12ykxw9iTSIgc92b51YeVO7kvwKeOk1s00mnan10O/1iXgBy2LibUFLi3s89:Cr1Pk0ieVcixsxG73QgBtio9icCHh","tlshash":"d3c153d9f72c053740f732dbe9ad96dc747d40a7a504042b7c78d86829a4c9920bafe9","size":6147,"data":"","first_seen":"2023-03-07T01:19:38Z","last_seen":"2026-07-22T19:28:44.637468Z","times_seen":210,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cursor.railway.cam/qqtime/qqtime.html","fqdn":"cursor.railway.cam","domain":"railway.cam","tld":"cam"},"ip":{"addr":"130.94.30.48","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"3df65e228bd8c59ff51fa216d946796e","sha1":"d2f8ffcf9d29a39f6b8f9cf73829b35868385d2e","sha256":"1be5e3621a98017f45e21a2df41e3027ca89c76e0a9b17fff51a5497e827ec77","sha512":"249849474fa1ee0aa6fe84f02e6844c406726b7648caa211463b4dfc088e9fecd02d4e5e73278c7ca930d6b3459e36941344e411b127bdfac73613e6d0ea9b53","ssdeep":"192:O7M9AkU2R/J9L2rS9n0IRiV/qmzhm1sG9GKAJw7EFc/lpnGIgOW8qJ+4qqFpi2m0:2M6kUI/bgS9n0IRiFqmzhmGG9GKAJw7M","tlshash":"ad02329972c1f85217436ba200b7040bf369e89835eac83cf4a5d9d53c7568681baffc","size":8335,"data":"","first_seen":"2026-03-04T10:06:21.801263Z","last_seen":"2026-07-22T19:28:44.648352Z","times_seen":97,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"tagivi.com/0f/ae/9b/0fae9bfe9e7f3facbc02597f741e5aa8.js?mg=1","fqdn":"tagivi.com","domain":"tagivi.com","tld":"com"},"ip":{"addr":"172.67.208.243","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9504693c306f0f3ab62774b1251e59a9","sha1":"ad07dc49feaf6226ed688998cae15d311cecc6ed","sha256":"00152a75b04205b189e9c064f1c61c6ac4852761e4e17e23bad697bad4662a65","sha512":"67607237fa07327bfc53a30bbaeb958685889eaf06c7861f671d62efb4805da38f0c75f4690e6551253f07d628bdbb78d785cf50b923cbf60dcd8f9d0e82997a","ssdeep":"1536:zE5bPKHLvSIcWfOnh+i7SeeSJWbRlIHTghP8o:zg+RxhW2RDR","tlshash":"5473c5846f71a29706a4707f322daa42f1281d0a648cf078fe3b74e7a45d759f63e271","size":75878,"data":"","first_seen":"2026-07-22T19:28:44.641646Z","last_seen":"2026-07-22T19:28:44.641646Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"ssp.semuadisini.xyz/41T7ql3.js","fqdn":"ssp.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"37.27.230.125","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Finland","country_code":"FI"},"introduction_type":"scriptElement","is_inline":false,"md5":"3f940965fcf68e23574d12017f10dbc6","sha1":"f44d863dc3bb6a666f8fe48a139b7ebea7cd3cec","sha256":"a08251f6fb9799532b51140534879addcdf180e05875852b67eca9868728a856","sha512":"4d4d24a4e1f832828f087cc8779fb55a5801c159483b49734576077091cafee50eafb5b90f6ea492bfbb619af7a165c048a023e3a2274df5b78f4040139bac0e","ssdeep":"1536:tIRGSJpE+unOJKBuLq6GkarC1K744dPOvYmJou4X/6qIzBOykczQsVdU14OulNgU:t7SJPuPuLHtQdPM1xznZMtDc","tlshash":"9b04958dbac1b15106a36164062f141af27b3a94b44ec480f66dd5d16fbae0fac77e2c","size":187138,"data":"","first_seen":"2026-07-03T08:30:14.213621Z","last_seen":"2026-07-22T20:42:18.817166Z","times_seen":122,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"asset.semuadisini.xyz/wp-content/themes/muvipro/js/tiny-custom.js?ver=2.1.9","fqdn":"asset.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"a8c2a29434b719d9867787d118262204","sha1":"95f331029d928af9bffb3022f10ce1d0acc3a7b4","sha256":"61382678bbc61b67488e3c0aaeb232e3191f8afd00d50c9ea7e81eb0e66cc2de","sha512":"cb6394b7ac688b0d510ba538ee983a572d6f528b3edf2ae0c25f72e3cf5e5c04733e254d76ba50b28a0944a1a979cefcbdc6f4aae5f241ee1c332d5300b1e20f","ssdeep":"","tlshash":"8ff0e5c0ba48417fe998f286d8b0eb48cf5edd31c52070b4f9860a7052e332344a1ccc","size":490,"data":"","first_seen":"2023-03-07T12:58:07Z","last_seen":"2026-07-22T19:28:44.617609Z","times_seen":76,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn2.tapioni.com/adgpt.js","fqdn":"cdn2.tapioni.com","domain":"tapioni.com","tld":"com"},"ip":{"addr":"172.66.163.179","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"971529bb571548f4c89e1e978a978cdf","sha1":"6ca24a87f4969c1a75d76214d9cb9eccfecf8b62","sha256":"a07cbaa80986b90f9222673affec7fa83c9f63f92b950fe113a6d7c89cb4c41c","sha512":"5985cbaeef1e1afc4500a87c365d7125bf9867239d7b1452d3e502e96a900eb207ab2754911b7057558fa3ce5713d7374be0d3e25a92869ce1daa30bf5df34fa","ssdeep":"","tlshash":"543110db31a1edb1078b6048602f1809f5fcb4a0a3ade8d1dfa5c9747d381484062eee","size":1837,"data":"","first_seen":"2026-07-03T08:30:14.105136Z","last_seen":"2026-07-22T20:42:18.902838Z","times_seen":141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"llvpn.com/tag.min.js","fqdn":"llvpn.com","domain":"llvpn.com","tld":"com"},"ip":{"addr":"104.21.13.59","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"237743bb3e76f188c8b010defcb2d8ec","sha1":"43cdb91c44e5ab65169258fa7feefd18601a19f8","sha256":"ec9cdcb9cf43fc234fa69a0254dfcfa6f20440060379a0605922e73279cb5a53","sha512":"af819b6e2618150296ac16b29af4fe5c5be10ccbbb2e33a5d28deaf8ea2935e257d00d3b609b97a1ef2c9c4eb7bfac1c5d52230df5bca10c34f28eae987a067a","ssdeep":"1536:aQm1B8Ou+5LwPDQfNg0XMOhTLeA7czJcelfLHs3QGExRGkMiOzUL00dPXxc:YgMf+0XdhPeA7iJ3tzsA1JMiC0Na","tlshash":"89931afa728631da126ba4ed805f7412f26f2de01e4d0161f058ac373c7991992bbf79","size":89077,"data":"","first_seen":"2026-07-22T14:26:57.934766Z","last_seen":"2026-07-22T21:23:26.865413Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"furiousexpansion.com/2d/14/a4/2d14a44f41adef437409b332dde956fc.js","fqdn":"furiousexpansion.com","domain":"furiousexpansion.com","tld":"com"},"ip":{"addr":"172.240.127.244","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0c22f41561961ff8f54c796956180950","sha1":"775cd694936c5b713ca85ab5c5070582f21739a1","sha256":"1bcb234d9c5409ede8f9cb83846b4d9effc8ece3f7dda5d8861e4b3548bc9f82","sha512":"0cc7b928bdf5c85491b2f3a9f10d6f83219dd29ea77d225a4613622323a1873bf5a18c5ecf515f4fa01f456343fd6029ffd027486e62e21f57eb065a9a426fbb","ssdeep":"384:pahiQJGjwKVhnbuueU87S0sTiRl6oBZxmeEWrg6ZOFgmR/07FZqXZ5:CiQJehQR9b4/WrxOFgXB4X/","tlshash":"fae26458bb92f8580293e0b6353fc01bf51a48517becd0a4e596d5fc2e79648f732b18","size":31132,"data":"","first_seen":"2026-07-22T19:28:44.63167Z","last_seen":"2026-07-22T19:28:44.63167Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cursor.railway.cam/qqtime/34ef644ff217a50beadde64dc8e23a7d.js","fqdn":"cursor.railway.cam","domain":"railway.cam","tld":"cam"},"ip":{"addr":"130.94.30.48","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8c43e2c16114e66cdd70b80ac84c824","sha1":"6fe725ad2cf8df011e6a6b4cbe259fbe4d33e23a","sha256":"327de4be0b8b768c4354ac9bcb3957f7c3712bf76e85198ca927ae4e9fceb119","sha512":"d4068fd99d83e888791e72b2144efe1afa501cbb8c749a1eaea950b0941dd860ea82f53efaf638c62b7854542dc5334a9169b3bcd26522641b9c2eb10f4aa38e","ssdeep":"768:gM3zThFJqWx7EyYPWtBBYBS/8XuxzddhycF45cNR83V4VJwCB39E/ynXGX/9aM7:Hz9qQEyruiDyTcNaKldXGL","tlshash":"8f337deea38026dc5cb4cce7a53706ad63f8db076c14326db38bae91b45f7109950729","size":50670,"data":"","first_seen":"2026-07-22T19:28:44.640695Z","last_seen":"2026-07-22T19:28:44.640695Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"asset.semuadisini.xyz/wp-content/plugins/pb-seo-friendly-images-pro//assets/js/unveil.js?ver=1.0.0","fqdn":"asset.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"94b9b09987f0b1fb45c27afeeded4935","sha1":"21828dcc8b44a415c747e5393f0fc4e025942e9a","sha256":"0054d12078ff2c32c5cbd742e561e77eb8b856b639438bfa25df52c7183788d9","sha512":"a87b04f12c36ec92868611d8855d98892b5c98aa2dfaaf3a13693e1ec9200ef0170260df8eb9b38ecac6b9292f8a5040e3839670620fb5fe7842be7c0cebb599","ssdeep":"","tlshash":"cd31122d7c6b322228337069cbbfe50a7752803b1904ea44fa0c21909fb5d3d13b5ed9","size":1735,"data":"","first_seen":"2023-03-10T10:52:56Z","last_seen":"2026-07-22T19:28:44.63012Z","times_seen":35,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cursor.railway.cam/qqtime/qqtime.html","fqdn":"cursor.railway.cam","domain":"railway.cam","tld":"cam"},"ip":{"addr":"130.94.30.48","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"aec2dea6fc4a5489a279d7824e64e639","sha1":"1b05002c9e2116f7f5f568cc0a6634c0c0ecfff3","sha256":"434841ec89b62c9114c067fdedaf960b029f198325e0bacdfc4caefd35ada39e","sha512":"f9b46fbad44e120343cdfe8812883d67ad126fbb1ffd6debde8c5eb60346c7effce6a4983838d140b9cc74502c020daf5c5576edd04c70697743477eba5f01ba","ssdeep":"","tlshash":"0ff0925ebbe750d1da623138176f71013032862b048fe9907b4c53985f96c178549bde","size":459,"data":"","first_seen":"2026-07-22T19:28:44.648848Z","last_seen":"2026-07-22T19:28:44.648848Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"JQMIGRATE: Migrate is installed, version 3.4.1","filename":"http://asset.semuadisini.xyz/wp-content/cache/wpfc-minified/kxyq1c0q/4e5ln.js","line_number":7,"column_number":981},{"level":"warn","text":"No slides found inmap[actor:server1.conn0.watcher14.process7//obj31 class:HTMLDivElement contentDomReference:map[browsingContextId:3 id:0.9260474900230726] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[class:gmr-owl-carousel owl-carousel owl-theme] attributesLength:1 isConnected:true kind:DOMNode nodeName:div nodeType:1] sealed:false type:object]","filename":"http://asset.semuadisini.xyz/wp-content/themes/muvipro/js/js-plugin-min.js?ver=2.1.9","line_number":13,"column_number":31859}]},"http":[{"url":{"schema":"https","addr":"static.nresystems.com/img.gif?h1id=1\u0026h3id=0\u0026key=0fae9bfe9e7f3facbc02597f741e5aa8\u0026uuid=019f8b4c-9dea-7595-937f-ec62117795cf","fqdn":"static.nresystems.com","domain":"nresystems.com","tld":"com"},"ip":{"addr":"104.18.19.137","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.055Z","timestamp":1784748482055,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /img.gif?h1id=1\u0026h3id=0\u0026key=0fae9bfe9e7f3facbc02597f741e5aa8\u0026uuid=019f8b4c-9dea-7595-937f-ec62117795cf HTTP/1.1\r\nHost: static.nresystems.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 22 Jul 2026 19:28:05 GMT\r\ncontent-type: image/gif\r\ncontent-length: 7\r\nserver: cloudflare\r\nexpires: Wed, 22 Jul 2026 23:28:05 GMT\r\ncache-control: public, max-age=14400\r\nvary: Origin\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,X-Forwarded-For,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\naccess-control-expose-headers: Content-Length,Content-Range\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1728000\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nset-cookie: uid_id2=019f8b4c-9dea-7595-937f-ec62117795cf; Expires=Sat, 19 Jul 2036 19:28:05 GMT; Secure; SameSite=None\n__cf_bm=PKyxjHEzNnZgpwY8nenix_FZoCGOkqexryUQW3QLzh4-1784748485.194809-1.0.1.1-.77OSgG89plaew7tPu31JLuyNMMn8LJp9umYhTpZYmMAhszNYq1ewtKqRsmMDmAoYHzgiHr6g.4eCphrTL2q.2Wp1x2knw0s6pW49UdNNVtr_5qWyuz_cRYEAU13TTnf; HttpOnly; SameSite=None; Secure; Path=/; Domain=nresystems.com; Expires=Wed, 22 Jul 2026 19:58:05 GMT\r\ncf-cache-status: BYPASS\r\ncf-ray: a1f4d8b0784156b4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"interlinecustomroofingllc.com/pixel/purst?dl=0\u0026th=0\u0026sc=0\u0026rs=602\u0026rd=602\u0026fd=349\u0026bv=2026.7.3\u0026tmpl=901","fqdn":"interlinecustomroofingllc.com","domain":"interlinecustomroofingllc.com","tld":"com"},"ip":{"addr":"172.67.147.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.058Z","timestamp":1784748482058,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"interlinecustomroofingllc.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 19 Jul 2026 15:55:52 GMT","end":"Sat, 17 Oct 2026 16:55:41 GMT"},"fingerprint":{"sha1":"D8:75:08:F4:89:20:93:9B:16:58:81:BA:E8:0D:C7:73:88:7A:C4:87","sha256":"07:DF:63:5D:68:A3:20:D7:81:75:31:8C:5D:7D:A3:9D:69:67:E5:1C:EF:55:82:EB:4B:32:1B:8C:1B:57:17:A6"}}},"request":{"raw":"GET /pixel/purst?dl=0\u0026th=0\u0026sc=0\u0026rs=602\u0026rd=602\u0026fd=349\u0026bv=2026.7.3\u0026tmpl=901 HTTP/1.1\r\nHost: interlinecustomroofingllc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 22 Jul 2026 19:28:02 GMT\r\ncontent-length: 0\r\nserver: cloudflare\r\nset-cookie: __cf_bm=N.tDOhY.hPSC4R_xxNOQVTxrq5tzFkfluTW.Ee6qnWI-1784748482.0738099-1.0.1.1-jWH9AgBZBQYO.Q1V5D0pe.5c4z50IyyYeOETLVrcs6jFbFLh_klwPw7XnXhi.oxqLieR1RAc4A9NmpWfpQgszovZKnzu5znIue9W0nTkt7GOxeuMed5EqHVrQPOvNbSB; HttpOnly; SameSite=None; Secure; Path=/; Domain=interlinecustomroofingllc.com; Expires=Wed, 22 Jul 2026 19:58:02 GMT\r\nstrict-transport-security: max-age=15552000; includeSubDomains; preload\r\naccept-ch: Sec-Ch-Ua-Model, Sec-Ch-Ua-Mobile, Device-Stock-Ua, X-Device-User-Agent, X-Operamini-Phone-Ua, Sec-Ch-Ua-Platform-Version, Sec-Ch-Ua, Sec-Ch-Ua-Platformuser-Agent, Sec-Ch-Ua-Platform, X-Ucbrowser-Device-Ua, User-Agent, Sec-Ch-Ua-Full-Version-List, Sec-Ch-Ua-Full-Version\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\ncache-control: no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a1f4d89cff6f8deb-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":0,"size_decoded":1232,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":5,"connect":6,"send":0,"wait":28,"receive":0,"ssl":13},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"cdn.storageimagedisplay.com/cti/4f/93/49/4f934901f84b39c0404054b2a4476544/1780322145.png","fqdn":"cdn.storageimagedisplay.com","domain":"storageimagedisplay.com","tld":"com"},"ip":{"addr":"45.133.44.2","port":80,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.803Z","timestamp":1784748482803,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /cti/4f/93/49/4f934901f84b39c0404054b2a4476544/1780322145.png HTTP/1.1\r\nHost: cdn.storageimagedisplay.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 19:28:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 155073\r\nConnection: keep-alive\r\nServer: nginx/1.21.6\r\nLast-Modified: Mon, 01 Jun 2026 13:55:45 GMT\r\nETag: \"6a1d8f61-25dc1\"\r\nExpires: Fri, 24 Jul 2026 19:28:02 GMT\r\nCache-Control: max-age=172800\r\nX-CDN-Host-ID: AH0543\r\nX-Proxy-Cache: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155073,"size_decoded":155430,"mime_type":"image/png","magic":"PNG image data, 320 x 240, 8-bit/color RGB, non-interlaced","md5":"dbf6341c11819120e495f3a46dc98331","sha1":"a5d6bbd86b521d881b5e9acae206af5833462cf3","sha256":"b81e2d6937f524b9945773d3ddfcfd27b149edcbeae42bf718ffb0a1b301d1c9","sha512":"72a0ac3bfeb61c4f3ec50b2e66004e0ab6a1a616da923f776cc430d428438b7716b7b05c4327df0f80f45a78bf9c164250ed563509eb27023960cd7079585792","ssdeep":"3072:m6bnWpdI2Wg3FSa2W6Z2rIE0VKresBMA5BN2513fHkYIb4Vcgw:/SdzWg3B2W600E0VmBBvYXVq4A","tlshash":"51e31248e91a6c294e5a033d9bfc4fb34a75f1a083f191e8d4b6ef6245789f464b50c3","first_seen":"2026-06-01T20:24:01.448936Z","last_seen":"2026-07-22T19:28:44.617082Z","times_seen":11,"resource_available":false,"data":null}},"time_used":116,"timings":{"blocked":-1,"dns":0,"connect":19,"send":0,"wait":20,"receive":76,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"asset.semuadisini.xyz/wp-content/uploads/2025/02/cropped-sohib21logo-60x60.png","fqdn":"asset.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:03.938Z","timestamp":1784748483938,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /wp-content/uploads/2025/02/cropped-sohib21logo-60x60.png HTTP/1.1\r\nHost: asset.semuadisini.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Wed, 22 Jul 2026 19:28:05 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nServer: BunnyCDN-NO1-830\r\nCDN-PullZone: 4107812\r\nCDN-RequestCountryCode: NO\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nAccess-Control-Expose-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nCache-Control: public, max-age=5\r\nLink: \u003chttps://sohib21.ink/wp-content/uploads/2025/02/cropped-sohib21logo-60x60.png\u003e; rel=\"canonical\"\r\ncdn-proxyver: 1.58\r\nCDN-RequestPullCode: 404\r\nCDN-RequestPullSuccess: True\r\ncdn-edgestorageid: 830\r\nCDN-CachedAt: 07/22/2026 19:28:05\r\ncdn-status: 404\r\ncdn-requesttime: 0\r\nCDN-RequestId: 15e55f5b94524a6fbb2900fc1b5b9b4f\r\nCDN-Cache: EXPIRED\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"asset.semuadisini.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"asset.semuadisini.xyz/wp-content/themes/muvipro/js/tiny-custom.js?ver=2.1.9","fqdn":"asset.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:01.865Z","timestamp":1784748481865,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /wp-content/themes/muvipro/js/tiny-custom.js?ver=2.1.9 HTTP/1.1\r\nHost: asset.semuadisini.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 19:28:01 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: BunnyCDN-NO1-830\r\nCDN-PullZone: 4107812\r\nCDN-RequestCountryCode: NO\r\nVary: Accept-Encoding, Accept-Encoding\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nAccess-Control-Expose-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nETag: \"67d4b6f3-1ea\"\r\nExpires: Sat, 18 Jul 2026 21:04:24 GMT\r\nLast-Modified: Fri, 14 Mar 2025 23:08:35 GMT\r\nLink: \u003chttps://sohib21.ink/wp-content/themes/muvipro/js/tiny-custom.js?ver=2.1.9\u003e; rel=\"canonical\"\r\nStrict-Transport-Security: max-age=31536000\r\ncdn-proxyver: 1.58\r\nCDN-RequestPullCode: 200\r\nCDN-RequestPullSuccess: True\r\ncdn-edgestorageid: 830\r\nCDN-CachedAt: 07/22/2026 12:07:57\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nCDN-RequestId: 2d25c71e23b690543415473fee2e8ad3\r\nCDN-Cache: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":490,"size_decoded":1403,"mime_type":"application/javascript","magic":"ASCII text, with CRLF line terminators","md5":"a8c2a29434b719d9867787d118262204","sha1":"95f331029d928af9bffb3022f10ce1d0acc3a7b4","sha256":"61382678bbc61b67488e3c0aaeb232e3191f8afd00d50c9ea7e81eb0e66cc2de","sha512":"cb6394b7ac688b0d510ba538ee983a572d6f528b3edf2ae0c25f72e3cf5e5c04733e254d76ba50b28a0944a1a979cefcbdc6f4aae5f241ee1c332d5300b1e20f","ssdeep":"","tlshash":"8ff0e5c0ba48417fe998f286d8b0eb48cf5edd31c52070b4f9860a7052e332344a1ccc","first_seen":"2023-03-07T12:58:07Z","last_seen":"2026-07-22T19:28:44.617609Z","times_seen":76,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":25,"connect":1,"send":0,"wait":3,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"asset.semuadisini.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.googletagmanager.com/gtag/js?id=G-KC8CB439VM","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":80,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:01.861Z","timestamp":1784748481861,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gtag/js?id=G-KC8CB439VM HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nLocation: https://www.googletagmanager.com/gtag/js?id=G-KC8CB439VM\r\nCross-Origin-Resource-Policy: cross-origin\r\nDate: Wed, 22 Jul 2026 19:28:01 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nServer: Google Tag Manager\r\nContent-Length: 253\r\nX-XSS-Protection: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":2,"connect":14,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"asset.semuadisini.xyz/wp-content/themes/muvipro/js/js-plugin-min.js?ver=2.1.9","fqdn":"asset.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:01.863Z","timestamp":1784748481863,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /wp-content/themes/muvipro/js/js-plugin-min.js?ver=2.1.9 HTTP/1.1\r\nHost: asset.semuadisini.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 19:28:01 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: BunnyCDN-NO1-830\r\nCDN-PullZone: 4107812\r\nCDN-RequestCountryCode: NO\r\nVary: Accept-Encoding, Accept-Encoding\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nAccess-Control-Expose-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nETag: \"67d4b6f3-aae5\"\r\nExpires: Sat, 18 Jul 2026 20:27:41 GMT\r\nLast-Modified: Fri, 14 Mar 2025 23:08:35 GMT\r\nLink: \u003chttps://sohib21.ink/wp-content/themes/muvipro/js/js-plugin-min.js?ver=2.1.9\u003e; rel=\"canonical\"\r\nStrict-Transport-Security: max-age=31536000\r\ncdn-proxyver: 1.58\r\nCDN-RequestPullCode: 200\r\nCDN-RequestPullSuccess: True\r\ncdn-edgestorageid: 830\r\nCDN-CachedAt: 07/22/2026 09:39:36\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nCDN-RequestId: 3f4c8177e2a5bdee42d10d5fada0fb91\r\nCDN-Cache: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":43749,"size_decoded":17761,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (31911)","md5":"3b56b9e4e536ef21f9bf645591bc288d","sha1":"6579714f0a6e2c16ddb4029ebf584e0755afe63d","sha256":"0812f1ec045cff5fcc841c5ae347cb299f3dbeed4141c9d21bc6a37f63623eae","sha512":"3f429b6565a4a1b5fda9517a7a56df27c90915c46fd27e9329dbc8ccd7da11ab3cff2d2e66f24c321b15586eac2de790814501b7537c815f197280ef4bfd956b","ssdeep":"768:7GllxCCMHzcEO4xIbsyNMH0JXm35lW2E9nUbTJuyynhdHbt3:SLQlHK9NMH0O5l+RUJuyQnt3","tlshash":"751309d97251313282e721e6129f420e72375828ed078948b439ede83dbd96d326fe7d","first_seen":"2023-03-07T01:19:38Z","last_seen":"2026-07-22T19:28:44.618146Z","times_seen":418,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":27,"connect":1,"send":0,"wait":3,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"asset.semuadisini.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"llvpn.com/tag.min.js","fqdn":"llvpn.com","domain":"llvpn.com","tld":"com"},"ip":{"addr":"104.21.13.59","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.291Z","timestamp":1784748482291,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /tag.min.js HTTP/1.1\r\nHost: llvpn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 19:28:02 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nX-Trace-Id: 787b7389aeb65b0804194bf7a0c8a3c9\r\nCache-Control: public, max-age=600, s-maxage=1800\r\nAccept-Ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon\r\nAccess-Control-Max-Age: 86400\r\nTiming-Allow-Origin: *\r\nContent-Encoding: gzip\r\nlast-modified: Wed, 22 Jul 2026 19:28:02 GMT\r\ncf-cache-status: EXPIRED\r\nvary: accept-encoding\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n4yghZ2LBmaS7hQ0YKMVOwhdcmcFV4Eb%2BZ9j5EPTX1qBgpoPZVKqCqe7XD3u9AIKqc%2B2KFOj5AMPUUHi2eVbNSFxvTz4liki%2FrM2CAYUiSg1k8w%2FTJGDo5FwjBY%3D\"}]}\r\nCF-RAY: a1f4d89e4c35b503-OSL\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89077,"size_decoded":41498,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"237743bb3e76f188c8b010defcb2d8ec","sha1":"43cdb91c44e5ab65169258fa7feefd18601a19f8","sha256":"ec9cdcb9cf43fc234fa69a0254dfcfa6f20440060379a0605922e73279cb5a53","sha512":"af819b6e2618150296ac16b29af4fe5c5be10ccbbb2e33a5d28deaf8ea2935e257d00d3b609b97a1ef2c9c4eb7bfac1c5d52230df5bca10c34f28eae987a067a","ssdeep":"1536:aQm1B8Ou+5LwPDQfNg0XMOhTLeA7czJcelfLHs3QGExRGkMiOzUL00dPXxc:YgMf+0XdhPeA7iJ3tzsA1JMiC0Na","tlshash":"89931afa728631da126ba4ed805f7412f26f2de01e4d0161f058ac373c7991992bbf79","first_seen":"2026-07-22T14:26:57.934766Z","last_seen":"2026-07-22T21:23:26.865413Z","times_seen":15,"resource_available":true,"data":null}},"time_used":103,"timings":{"blocked":-1,"dns":2,"connect":1,"send":0,"wait":73,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"furiousexpansion.com/ren.gif?sid=H4sIAAAAAAAC_1xSP4wbxReedaxf8ytQAEWi24ICJOzbWXu93qRAivhTAHeIBEWCav6aidc7m51d27GElCMIie4KhCjXn-9yaYigpgEfHVW2QLoi11BTISFK5DtLFzHFe2_eNxp933vfV8vqjHRRsdMPP7ALk6ZsJ-oG_mt3TCbtzPm7t30adIMb_h2TDfo3_PkmFNPrtNfvBq_77yoxtjthQIOABtR_xxRK2_nOOQqTP6FJ1B30u5QOuzQKMS_-23GVB8c8yOkZeRFGNi_8oT-FEWtkkx_eUm5c2vyNtydVykpbYCqPP87GmZ1lmFyWuvCgs-Pta1jXEPJdCzY73qqAnR5uVICbhrSuPQPPjrdUwadHF2x5CpWBy_9jNl1DpWsYtoawD2HkUwIIid09ZJNHu7aYsfsXKNugDWn__RfMrCHtZy8jmzy5mZq5f8umVWls5jDXNcx8DTNaI69OUC5aMLMTiPILGEmQTZYdGHn6akATPeR90UmkYp04SqJO0ot1R4lBSGkcJ5HQ57Mxeg3mrqByHirjodItVHkLE3nqs2SoeTLos0TpWMuAxoJFvV4S96NQD0SESuzDyAOI4gHyYv-x7MWqx0V_yTA2B3DSgysJprI-kqkLXf1Ipq7idJvDbe7VK1uOluzIliOVEbDiAIWsD01-zz2EKK-sFtrJld0Exst6xbisV0aWBMW957SyYJB0YjnQHRZGUYcOgkGsh1zJUBxqV1b1Mj8jVzdj9o7_NBirUz-Mk1CIngwp01omQ60Y44FQlMUx5TGHMzWMa4E5DwvTkPdGXyM3DfE-b4GzE7j0BMJ4YBUFm9Vgn9VYZN9zY93Y5iHtbnwkbY28bKO87y3TM_LS6qPbN38-X7c6-wlK_Ea2B6KokRc17ppfCUbp_o97eWkmZsE2-79VslL9D8w83fsHwjTk2tVvz414PexD5A_g8sufnCXgeRupIUjVZZ_xGu65O7-sl-5LjIo2eNpe8bRoH_K0SL9pyPvm94Z88vjNhqhfFhecnTn1A9lXVCQsirWKoohH_VBozYM41L1eOExQuuYue2X9bwAAAP__l7SqlhkEAAA=","fqdn":"furiousexpansion.com","domain":"furiousexpansion.com","tld":"com"},"ip":{"addr":"172.240.127.244","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.813Z","timestamp":1784748482813,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"furiousexpansion.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 21:40:07 GMT","end":"Wed, 23 Sep 2026 21:40:06 GMT"},"fingerprint":{"sha1":"81:6B:A0:BD:75:1F:EB:D5:DD:2D:06:86:4C:AC:44:33:8B:11:5A:CF","sha256":"D9:B3:84:86:0A:17:E7:7F:7A:93:D3:8F:17:B0:68:8F:10:08:3D:85:77:CF:94:4F:10:18:83:B2:FE:C5:1D:80"}}},"request":{"raw":"GET /ren.gif?sid=H4sIAAAAAAAC_1xSP4wbxReedaxf8ytQAEWi24ICJOzbWXu93qRAivhTAHeIBEWCav6aidc7m51d27GElCMIie4KhCjXn-9yaYigpgEfHVW2QLoi11BTISFK5DtLFzHFe2_eNxp933vfV8vqjHRRsdMPP7ALk6ZsJ-oG_mt3TCbtzPm7t30adIMb_h2TDfo3_PkmFNPrtNfvBq_77yoxtjthQIOABtR_xxRK2_nOOQqTP6FJ1B30u5QOuzQKMS_-23GVB8c8yOkZeRFGNi_8oT-FEWtkkx_eUm5c2vyNtydVykpbYCqPP87GmZ1lmFyWuvCgs-Pta1jXEPJdCzY73qqAnR5uVICbhrSuPQPPjrdUwadHF2x5CpWBy_9jNl1DpWsYtoawD2HkUwIIid09ZJNHu7aYsfsXKNugDWn__RfMrCHtZy8jmzy5mZq5f8umVWls5jDXNcx8DTNaI69OUC5aMLMTiPILGEmQTZYdGHn6akATPeR90UmkYp04SqJO0ot1R4lBSGkcJ5HQ57Mxeg3mrqByHirjodItVHkLE3nqs2SoeTLos0TpWMuAxoJFvV4S96NQD0SESuzDyAOI4gHyYv-x7MWqx0V_yTA2B3DSgysJprI-kqkLXf1Ipq7idJvDbe7VK1uOluzIliOVEbDiAIWsD01-zz2EKK-sFtrJld0Exst6xbisV0aWBMW957SyYJB0YjnQHRZGUYcOgkGsh1zJUBxqV1b1Mj8jVzdj9o7_NBirUz-Mk1CIngwp01omQ60Y44FQlMUx5TGHMzWMa4E5DwvTkPdGXyM3DfE-b4GzE7j0BMJ4YBUFm9Vgn9VYZN9zY93Y5iHtbnwkbY28bKO87y3TM_LS6qPbN38-X7c6-wlK_Ea2B6KokRc17ppfCUbp_o97eWkmZsE2-79VslL9D8w83fsHwjTk2tVvz414PexD5A_g8sufnCXgeRupIUjVZZ_xGu65O7-sl-5LjIo2eNpe8bRoH_K0SL9pyPvm94Z88vjNhqhfFhecnTn1A9lXVCQsirWKoohH_VBozYM41L1eOExQuuYue2X9bwAAAP__l7SqlhkEAAA= HTTP/1.1\r\nHost: furiousexpansion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nCookie: uid_id2=019f8b4c-9dea-7595-937f-ec62117795cf:3:1; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; u_pl27782505=1; nlec2792cc3d21affd98feaab0ce1a771b7b=[5941311]\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Wed, 22 Jul 2026 19:28:03 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccept-ch: Sec-Ch-Ua-Platform,Sec-Ch-Ua-Model,Sec-Ch-Ua-Mobile,X-Device-User-Agent,X-Operamini-Phone-Ua,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua,Sec-Ch-Ua-Full-Version,Device-Stock-Ua,X-Ucbrowser-Device-Ua,User-Agent,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version-List\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\nvary: Origin,Accept-Encoding\r\nx-envoy-upstream-service-time: 4\r\nHost: furiousexpansion.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: b4aa14068b6f1cff8c7590f566822f1d\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"furiousexpansion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"asset.semuadisini.xyz/wp-content/cache/wpfc-minified/kxyq1c0q/4e5ln.js","fqdn":"asset.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:01.825Z","timestamp":1784748481825,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /wp-content/cache/wpfc-minified/kxyq1c0q/4e5ln.js HTTP/1.1\r\nHost: asset.semuadisini.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 19:28:01 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: BunnyCDN-NO1-830\r\nCDN-PullZone: 4107812\r\nCDN-RequestCountryCode: NO\r\nVary: Accept-Encoding, Accept-Encoding\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nAccess-Control-Expose-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nETag: \"6a59b065-18bb4\"\r\nExpires: Tue, 21 Jul 2026 20:55:36 GMT\r\nLast-Modified: Fri, 17 Jul 2026 04:32:37 GMT\r\nLink: \u003chttps://sohib21.ink/wp-content/cache/wpfc-minified/kxyq1c0q/4e5ln.js\u003e; rel=\"canonical\"\r\nStrict-Transport-Security: max-age=31536000\r\ncdn-proxyver: 1.58\r\nCDN-RequestPullCode: 200\r\nCDN-RequestPullSuccess: True\r\ncdn-edgestorageid: 830\r\nCDN-CachedAt: 07/22/2026 09:32:05\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nCDN-RequestId: 43cc86b1604567f14521f99e6e539033\r\nCDN-Cache: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":101300,"size_decoded":36004,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65366)","md5":"dbda7ff041ae2d7b54f49fcf552c3d00","sha1":"7d6db9646c4659d5ecceaed3a75a97d5c35aae80","sha256":"1abb63db89fb7f6da277ac6d6a56cc3549ec33bf1b8bc923b593f64090909b00","sha512":"f462d728991a81cd14963ac67efd7d19f769ddc42f4c08392d66987394172850c012ef792f8d7bc7756492f89f19b093665f3747a1cfcd31003dfd2aadced9de","ssdeep":"1536:nRUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKhrP7QK:fHNwcv9VBQpLl88SMBQ47GKhrPU+B","tlshash":"25a308df769ab4224bb730b9507f510bb276099d680d4400f199d8eabc7c94a823bf7d","first_seen":"2025-04-16T03:23:59.357407Z","last_seen":"2026-07-22T19:28:44.619859Z","times_seen":9,"resource_available":true,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":65,"connect":1,"send":0,"wait":3,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"asset.semuadisini.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"asset.semuadisini.xyz/wp-content/cache/wpfc-minified/6opunyqz/4e5lo.css","fqdn":"asset.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:01.820Z","timestamp":1784748481820,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /wp-content/cache/wpfc-minified/6opunyqz/4e5lo.css HTTP/1.1\r\nHost: asset.semuadisini.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 19:28:01 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: BunnyCDN-NO1-830\r\nCDN-PullZone: 4107812\r\nCDN-RequestCountryCode: NO\r\nVary: Accept-Encoding, Accept-Encoding\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nAccess-Control-Expose-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nETag: \"6a59b065-13551\"\r\nExpires: Tue, 21 Jul 2026 20:55:36 GMT\r\nLast-Modified: Fri, 17 Jul 2026 04:32:37 GMT\r\nLink: \u003chttps://sohib21.ink/wp-content/cache/wpfc-minified/6opunyqz/4e5lo.css\u003e; rel=\"canonical\"\r\nStrict-Transport-Security: max-age=31536000\r\ncdn-proxyver: 1.58\r\nCDN-RequestPullCode: 200\r\nCDN-RequestPullSuccess: True\r\ncdn-edgestorageid: 830\r\nCDN-CachedAt: 07/22/2026 09:33:05\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nCDN-RequestId: 24265531ff3cdfa77d26a29a5328b687\r\nCDN-Cache: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":79185,"size_decoded":40715,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"3c5eb2212ca968f72914f8feeac58464","sha1":"e4e7205776c796570d2b36996093cbed5352ae36","sha256":"1da1e029294631c94a3d0b99a045f8af2dee05f3b1740dffc014ef06cf0e269c","sha512":"8f7d4144cc827b45d33c94212c9e08f652f9bbdd8f21d5a87746ef91cfcd65b1cf449abc2f967744a51db2a22e5f2e1e0a87b7ce1114d494f75d99278e628b8b","ssdeep":"768:8ey/Z24B3P3aXOhUzSv16CAyLquqSfurIdUMbs73KO08QSJ2BQH02CRqxMWs5IJa:8x/ZvB/qPWMiquqioMUXQSJYIMW+IJ72","tlshash":"4e73e9a0de592ac527f1c893af96f27b1595b939b842cc9ef02b450c05d33360dadf29","first_seen":"2025-09-20T22:28:41.514192Z","last_seen":"2026-07-22T19:28:44.62079Z","times_seen":7,"resource_available":false,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":69,"connect":1,"send":0,"wait":2,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"asset.semuadisini.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"workdeadlinededicate.com/pop.json?key=2d14a44f41adef437409b332dde956fc\u0026uuid=019f8b4c-9dea-7595-937f-ec62117795cf","fqdn":"workdeadlinededicate.com","domain":"workdeadlinededicate.com","tld":"com"},"ip":{"addr":"172.240.253.132","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.790Z","timestamp":1784748482790,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"workdeadlinededicate.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Jun 2026 03:50:31 GMT","end":"Fri, 25 Sep 2026 03:50:30 GMT"},"fingerprint":{"sha1":"10:47:66:26:DB:09:A5:17:78:DA:F0:CB:92:C3:2C:F2:8D:0B:43:39","sha256":"D3:7C:24:3F:AE:83:AA:B8:BE:F8:93:F7:33:46:24:C5:B4:D3:32:B8:10:D0:21:AA:C0:0A:65:7B:33:B8:AA:5B"}}},"request":{"raw":"GET /pop.json?key=2d14a44f41adef437409b332dde956fc\u0026uuid=019f8b4c-9dea-7595-937f-ec62117795cf HTTP/1.1\r\nHost: workdeadlinededicate.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: http://212.212.104.25\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Wed, 22 Jul 2026 19:28:03 GMT\r\nContent-Type: application/json\r\nContent-Length: 0\r\nConnection: keep-alive\r\naccept-ch: Sec-Ch-Ua-Full-Version,Sec-Ch-Ua-Model,Sec-Ch-Ua-Mobile,Device-Stock-Ua,X-Device-User-Agent,User-Agent,Sec-Ch-Ua,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version-List,Sec-Ch-Ua-Platform,X-Operamini-Phone-Ua,X-Ucbrowser-Device-Ua,Sec-Ch-Ua-Platform-Version\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: http://212.212.104.25\r\nset-cookie: uid_id2=019f8b4c-9dea-7595-937f-ec62117795cf:3:1; Path=/; Expires=Wed, 29 Jul 2026 19:28:03 GMT; Secure; SameSite=None\r\nvary: Accept-Encoding\r\nx-envoy-upstream-service-time: 29\r\nHost: workdeadlinededicate.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: e9925b029d73a9f0cf22a2a30a4f2cba\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":956,"mime_type":"application/json","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":404,"timings":{"blocked":0,"dns":3,"connect":91,"send":0,"wait":124,"receive":0,"ssl":185},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"workdeadlinededicate.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"workdeadlinededicate.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"cdn.storageimagedisplay.com/cti/10/56/e0/1056e07b8d667ee2cc889daba9aefc51/1708428577.jpg","fqdn":"cdn.storageimagedisplay.com","domain":"storageimagedisplay.com","tld":"com"},"ip":{"addr":"45.133.44.2","port":80,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.797Z","timestamp":1784748482797,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /cti/10/56/e0/1056e07b8d667ee2cc889daba9aefc51/1708428577.jpg HTTP/1.1\r\nHost: cdn.storageimagedisplay.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 19:28:02 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 26901\r\nConnection: keep-alive\r\nServer: nginx/1.21.6\r\nLast-Modified: Tue, 20 Feb 2024 11:29:45 GMT\r\nETag: \"65d48d29-6915\"\r\nExpires: Fri, 24 Jul 2026 19:28:02 GMT\r\nCache-Control: max-age=172800\r\nX-CDN-Host-ID: AH0543\r\nX-Proxy-Cache: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26901,"size_decoded":27257,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 320x240, components 3","md5":"54b8d54ac75bf580892d7b04a7da9033","sha1":"33cdb171dc7a5405ea35dab874e50d1543a853fd","sha256":"35b31ba5494b05b0bae6c049c317860ab6f6c68cd18c6f28e2aaeb901e0984a2","sha512":"d4825bb7bc2ba890ecb9e91c34c30076ffbf4e4b27e2e61630f33ba4d52423bb9c89f0ed00ef981c5cd00a3e5e48f6a0dcd594020a2da49ddffecbafd053be1c","ssdeep":"384:YKuEHfBNvJfrXM9dd/yZE1r0gHBZZClSyPXb6Nlwi2ntu9SU1+4MNTisnaahR2:YKuEJPfrXE6ZiOPXbfntuZ1zMNmsab","tlshash":"c0c2e1e5c6c7068c397494a6b30d7ed7e5abc1b4f00f11472af065fc4462a26dd88aee","first_seen":"2024-03-02T22:13:01Z","last_seen":"2026-07-22T19:28:44.621801Z","times_seen":67,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":3,"connect":20,"send":0,"wait":20,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tagivi.com/3/0fae9bfe9e7f3facbc02597f741e5aa8?uidm=019f8b4c-9dea-7595-937f-ec62117795cf_1","fqdn":"tagivi.com","domain":"tagivi.com","tld":"com"},"ip":{"addr":"172.67.208.243","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:03.453Z","timestamp":1784748483453,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tagivi.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 19 Jul 2026 16:52:57 GMT","end":"Sat, 17 Oct 2026 17:52:51 GMT"},"fingerprint":{"sha1":"EB:03:AE:39:98:D1:E6:52:78:12:1F:F2:8F:E8:64:39:78:C0:2B:B8","sha256":"CB:EB:EE:A5:FB:55:E0:5B:D5:D4:83:21:BB:F9:11:66:4F:A2:17:74:B4:63:78:C7:04:C1:6E:E5:CA:00:FF:9E"}}},"request":{"raw":"GET /3/0fae9bfe9e7f3facbc02597f741e5aa8?uidm=019f8b4c-9dea-7595-937f-ec62117795cf_1 HTTP/1.1\r\nHost: tagivi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: http://212.212.104.25\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nCookie: __cf_bm=D6d6CNXSXiUunn.Zc6Dfv5v94_KN.JkU_puFZ16853M-1784748481.8279684-1.0.1.1-wAWOpHdVT_GBh_BCIB5ys05700C6t8logb4kuveXyBYxL3.KgLMWAgz4HDfLG0Xxgiz4GaBmD6fXWc5SaKEeT5IxPZ2guqInxdRNj6Wd7DqXA.AjV9h93kj2deF0TH4C; uidm=019f8b4c-9dea-7595-937f-ec62117795cf_1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 22 Jul 2026 19:28:03 GMT\r\ncontent-type: text/plain\r\nserver: cloudflare\r\naccept-ch: Sec-Ch-Ua-Mobile,Device-Stock-Ua,X-Device-User-Agent,X-Operamini-Phone-Ua,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version-List,Sec-Ch-Ua-Platform,X-Ucbrowser-Device-Ua,User-Agent,Sec-Ch-Ua,Sec-Ch-Ua-Full-Version,Sec-Ch-Ua-Model\r\nvary: Accept-Encoding, Origin\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\ncache-control: no-cache, max-age=0, private, no-cache\r\nx-request-id: ef97706e94bd1495787a3eaef53792d6\r\npragma: no-cache\r\naccess-control-allow-origin: http://212.212.104.25\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,X-Forwarded-For,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\naccess-control-expose-headers: Content-Length,Content-Range\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1728000\r\nstrict-transport-security: max-age=0; includeSubdomains\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: gzip\r\ncf-ray: a1f4d8a58a5c5a0f-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":76,"size_decoded":1228,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"58da1f449b552a82d99b83e8bab35cf4","sha1":"cb422f329dc49321b99cc62bbe3cb0a12c87df0b","sha256":"d1415432dd92e925b1d85efb0bbb13772099e1cc429510ec2924b477d58c7db3","sha512":"5c02483ee03b0bacf36382349b787267140b391f75973489d93bc5800bf9a8bebad9601d45653ed87a4322b2f1b56eab10a90e85e0c82d54b41467327cbd6420","ssdeep":"","tlshash":"aaa0228a0caf23302e0bab0300033800c008cccf302f2883303b83e0088c2a003f8aac","first_seen":"2026-07-22T19:28:44.622589Z","last_seen":"2026-07-22T19:28:44.622589Z","times_seen":1,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"furiousexpansion.com/ren.gif?sid=H4sIAAAAAAAC_1xSPYwbRRSedQwNBeJHSHQrRAEI-3bWXq-XFEgRPwVwh0hQJKjm10y83tns7NqOJaQcQUh0VyBEuf58l0tDBDUN-OiosgXSFbmGmgoJpUS-WLqIKd57877R6Pve-75ZVmeki4qdfvyRXZg0ZTtRN_Bfu24yaWfO373m06AbXPavm2zQv-zPN6GYvkV7_W7wuv--EmO7EwY0CGhA_fdMobSd75yjMPl9mkTdQb9L6bBLoxDz4v8dV3lwzIOcnpHnYWTz7F_6cxixRjb56R3lxqXN33x3UqWstAWm8vjTbJzZWYbJRakLDzo73r6GdQ0hP7Rgs-OtCtjp4UYFuGlI66WH4Nnxlir49OgxW55CZeDyGcyma6h0DcPWEPYOjHxAACGxu4dscnfXFjN26zHKNmhD2v_-AzNrSPvhi8gm96-kZu5ftWlVGps5zHUNM1_DjNbIqxOUixbM7ASi_ApGEmSTZQdGnr4a0EQPeV90EqlYJ46SqJP0Yt1RYhBSGsdJJPT5bIxeg7lLqJyHyniodAtV3sJEnvosGWqeDPosUTrWMqCxYFGvl8T9KNQDEaES-zDyAKK4jbzYvyd7sepx0V8yjM0BnPTgSoKprI9k6kJX35Wpqzjd5nCbe_XKlqMlO7LlSGUErDhAIetDk990dyDKS6uFdnJlN4Hxsl4xLuuVkSVBcfMJrSwYJJ1YDnSHhVHUoYNgEOshVzIUh9qVVb3Mz8hzmzF7x38bjNWpH8ZJKERPhpRpLZOhVozxQCjK4pjymMOZGsa1wJyHhWnIB6NvkZuGeF-2wNkJXHoCYTywioLNarAvaiyyH7mxbmzzkHY3PpK2Rl62Ud7ylukZeWH1ybUrv56v-0PzJ5T4g2wPRFEjL2rcML8TjNL9n_fy0kzMgm32f7VkpXoazDzYewRhGvLUo1fOjfjG9zVEfhsuv_jJWQKee0gNQaou-ozXcE_c-UW9dF9jVLTB0_aKp0X7kKdF-t05yYZ8du_thqjfFg1RZ7_AmVM_kH1FRcKiWKsoinjUD4XWPIhD3euFwwSla26wl9f_BQAA__8fqCFDGQQAAA==","fqdn":"furiousexpansion.com","domain":"furiousexpansion.com","tld":"com"},"ip":{"addr":"172.240.127.244","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.808Z","timestamp":1784748482808,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"furiousexpansion.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 21:40:07 GMT","end":"Wed, 23 Sep 2026 21:40:06 GMT"},"fingerprint":{"sha1":"81:6B:A0:BD:75:1F:EB:D5:DD:2D:06:86:4C:AC:44:33:8B:11:5A:CF","sha256":"D9:B3:84:86:0A:17:E7:7F:7A:93:D3:8F:17:B0:68:8F:10:08:3D:85:77:CF:94:4F:10:18:83:B2:FE:C5:1D:80"}}},"request":{"raw":"GET /ren.gif?sid=H4sIAAAAAAAC_1xSPYwbRRSedQwNBeJHSHQrRAEI-3bWXq-XFEgRPwVwh0hQJKjm10y83tns7NqOJaQcQUh0VyBEuf58l0tDBDUN-OiosgXSFbmGmgoJpUS-WLqIKd57877R6Pve-75ZVmeki4qdfvyRXZg0ZTtRN_Bfu24yaWfO373m06AbXPavm2zQv-zPN6GYvkV7_W7wuv--EmO7EwY0CGhA_fdMobSd75yjMPl9mkTdQb9L6bBLoxDz4v8dV3lwzIOcnpHnYWTz7F_6cxixRjb56R3lxqXN33x3UqWstAWm8vjTbJzZWYbJRakLDzo73r6GdQ0hP7Rgs-OtCtjp4UYFuGlI66WH4Nnxlir49OgxW55CZeDyGcyma6h0DcPWEPYOjHxAACGxu4dscnfXFjN26zHKNmhD2v_-AzNrSPvhi8gm96-kZu5ftWlVGps5zHUNM1_DjNbIqxOUixbM7ASi_ApGEmSTZQdGnr4a0EQPeV90EqlYJ46SqJP0Yt1RYhBSGsdJJPT5bIxeg7lLqJyHyniodAtV3sJEnvosGWqeDPosUTrWMqCxYFGvl8T9KNQDEaES-zDyAKK4jbzYvyd7sepx0V8yjM0BnPTgSoKprI9k6kJX35Wpqzjd5nCbe_XKlqMlO7LlSGUErDhAIetDk990dyDKS6uFdnJlN4Hxsl4xLuuVkSVBcfMJrSwYJJ1YDnSHhVHUoYNgEOshVzIUh9qVVb3Mz8hzmzF7x38bjNWpH8ZJKERPhpRpLZOhVozxQCjK4pjymMOZGsa1wJyHhWnIB6NvkZuGeF-2wNkJXHoCYTywioLNarAvaiyyH7mxbmzzkHY3PpK2Rl62Ud7ylukZeWH1ybUrv56v-0PzJ5T4g2wPRFEjL2rcML8TjNL9n_fy0kzMgm32f7VkpXoazDzYewRhGvLUo1fOjfjG9zVEfhsuv_jJWQKee0gNQaou-ozXcE_c-UW9dF9jVLTB0_aKp0X7kKdF-t05yYZ8du_thqjfFg1RZ7_AmVM_kH1FRcKiWKsoinjUD4XWPIhD3euFwwSla26wl9f_BQAA__8fqCFDGQQAAA== HTTP/1.1\r\nHost: furiousexpansion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nCookie: uid_id2=019f8b4c-9dea-7595-937f-ec62117795cf:3:1; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; u_pl27782505=1; nlec2792cc3d21affd98feaab0ce1a771b7b=[5941311]\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Wed, 22 Jul 2026 19:28:02 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccept-ch: X-Device-User-Agent,X-Ucbrowser-Device-Ua,User-Agent,Sec-Ch-Ua,Sec-Ch-Ua-Platform,Sec-Ch-Ua-Model,Device-Stock-Ua,X-Operamini-Phone-Ua,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version-List,Sec-Ch-Ua-Full-Version,Sec-Ch-Ua-Mobile\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\nvary: Origin,Accept-Encoding\r\nx-envoy-upstream-service-time: 2\r\nHost: furiousexpansion.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 08ed3ff158f0c4af79b95da75a4f062b\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"furiousexpansion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"smallestpawsmention.com/2792cc3d21affd98feaab0ce1a771b7b/invoke.js","fqdn":"smallestpawsmention.com","domain":"smallestpawsmention.com","tld":"com"},"ip":{"addr":"172.240.108.68","port":80,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:01.860Z","timestamp":1784748481860,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /2792cc3d21affd98feaab0ce1a771b7b/invoke.js HTTP/1.1\r\nHost: smallestpawsmention.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Wed, 22 Jul 2026 19:28:02 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\naccept-ch: Sec-Ch-Ua-Full-Version-List,Sec-Ch-Ua-Model,Sec-Ch-Ua-Mobile,Device-Stock-Ua,X-Device-User-Agent,X-Operamini-Phone-Ua,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version,Sec-Ch-Ua-Platform,X-Ucbrowser-Device-Ua,User-Agent,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nx-envoy-upstream-service-time: 1\r\nHost: smallestpawsmention.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 7ee000141fd75248cb82b5a7c0b3e22c\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48347,"size_decoded":18422,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (48345), with no line terminators","md5":"c1ee40cd3e80bb4c9b5e740c0c821344","sha1":"35aa9718f1b643e6459ae7e105880f5c3c4f1898","sha256":"c592bc2e429359e226a0859b59c403df3a3c2661838136d90ad07749877ba635","sha512":"6c9b85721ded54a0463fffe7217fdfb32366756ab1e8ffeb41afe7d6294150319c5b864cf95df1074356e7b358ead725f69a14ac29f5b59ad029541c14302036","ssdeep":"768:uLB+fWzKIfKdVSvou674jfwpnzYJEOlhPgul4wlA:KB+f+CdIvh6sCnfvwA","tlshash":"cc23a88c7f91f16c16576073253f910af1294e62e4a89688d263f07c1a6c33dda7ebd8","first_seen":"2026-07-22T19:28:44.623514Z","last_seen":"2026-07-22T19:28:44.623514Z","times_seen":1,"resource_available":true,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":53,"connect":90,"send":0,"wait":94,"receive":91,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"smallestpawsmention.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cursor.railway.cam/qqtime/qqtime.html","fqdn":"cursor.railway.cam","domain":"railway.cam","tld":"cam"},"ip":{"addr":"130.94.30.48","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:03.127Z","timestamp":1784748483127,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cursor.railway.cam","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 19:15:08 GMT","end":"Thu, 01 Oct 2026 19:15:07 GMT"},"fingerprint":{"sha1":"61:00:91:A8:21:A7:F7:68:B6:EF:D6:85:2C:0E:94:F5:E6:CD:E7:CB","sha256":"09:EA:9D:A4:AF:F2:5C:CF:B3:52:44:F4:3E:BE:D5:7A:4F:AA:63:96:DF:4A:66:63:A9:D6:3B:14:39:C1:F3:A4"}}},"request":{"raw":"GET /qqtime/qqtime.html HTTP/1.1\r\nHost: cursor.railway.cam\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://212.212.104.25/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 19:28:04 GMT\r\ncontent-type: text/html\r\ncontent-length: 1003\r\nlast-modified: Tue, 21 Jul 2026 01:10:17 GMT\r\netag: \"6a5ec6f9-3eb\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1003,"size_decoded":1440,"mime_type":"text/html","magic":"JavaScript source, ASCII text","md5":"3d17afc692f1be2cf1b12daaf7c11161","sha1":"8bebe4252baa614ee5a3620b827271a85521e4c3","sha256":"06483ed7cb1bcc4735d2d8c45c452372c02b9ea780d57b3879974913d53f5966","sha512":"f07f13458a75151b26f84d5cc89b64185db917b752a5c724c00e0a3a1be4fb7261f5628240751d5806b38d7e05c75ef5a7751378352dd976344abf5081d14ad8","ssdeep":"","tlshash":"cb11105bbe8250728822227422af710070758503218acc50b3dc52ef4fd6f05cc436ef","first_seen":"2026-07-22T19:28:44.624304Z","last_seen":"2026-07-22T19:28:44.624304Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1302,"timings":{"blocked":0,"dns":0,"connect":324,"send":0,"wait":324,"receive":0,"ssl":653},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"cursor.railway.cam","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"cursor.railway.cam","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipsadminuser.shop/api/ip-sync/sync","fqdn":"ipsadminuser.shop","domain":"ipsadminuser.shop","tld":"shop"},"ip":{"addr":"172.67.205.92","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cursor.railway.cam/qqtime/qqtime.html","date":"2026-07-22T19:28:27.202Z","timestamp":1784748507202,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipsadminuser.shop","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 23 Jun 2026 18:20:42 GMT","end":"Mon, 21 Sep 2026 18:20:41 GMT"},"fingerprint":{"sha1":"9B:DF:EE:39:98:FB:B8:1F:A6:1E:E4:B8:13:3D:90:3B:F1:FB:0C:4C","sha256":"94:57:B8:50:98:AB:A7:AE:B7:29:CD:4D:D6:4C:E5:6F:7B:1A:5B:63:FC:33:A8:29:55:0A:29:30:C5:0E:07:5C"}}},"request":{"raw":"OPTIONS /api/ip-sync/sync HTTP/1.1\r\nHost: ipsadminuser.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://cursor.railway.cam/\r\nOrigin: https://cursor.railway.cam\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 19:28:27 GMT\r\nserver-timing: cfExtPri\r\nset-cookie: bt_route=3b9b48f1f218cfad90e1b5c33491d768; Expires=Thu, 23-Jul-2026 07:28:27 GMT; Path=/; HttpOnly\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://cursor.railway.cam\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: content-type\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=juDaXcbmYXKANyWsegcHh%2BZG0filLX3vhRIW0bzQPEUgZv8iOtqH57zecgEyPogUC7GQ9yis8Z8cotyZM7NJWllOZLXEBOCOV7ZDs6kFRKCsLFTFCWyjT0NTq8xFvAoUb9buvQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: a1f4d939fdb856c6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":1031,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":201,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":201,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"furiousexpansion.com/ntv.json?key=2792cc3d21affd98feaab0ce1a771b7b\u0026vstc=4\u0026uuid=019f8b4c-9dea-7595-937f-ec62117795cf\u0026custom=%7B%22d37e3bc4%22%3A%22a%22%7D\u0026rb=e","fqdn":"furiousexpansion.com","domain":"furiousexpansion.com","tld":"com"},"ip":{"addr":"172.240.127.244","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.335Z","timestamp":1784748482335,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"furiousexpansion.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 21:40:07 GMT","end":"Wed, 23 Sep 2026 21:40:06 GMT"},"fingerprint":{"sha1":"81:6B:A0:BD:75:1F:EB:D5:DD:2D:06:86:4C:AC:44:33:8B:11:5A:CF","sha256":"D9:B3:84:86:0A:17:E7:7F:7A:93:D3:8F:17:B0:68:8F:10:08:3D:85:77:CF:94:4F:10:18:83:B2:FE:C5:1D:80"}}},"request":{"raw":"GET /ntv.json?key=2792cc3d21affd98feaab0ce1a771b7b\u0026vstc=4\u0026uuid=019f8b4c-9dea-7595-937f-ec62117795cf\u0026custom=%7B%22d37e3bc4%22%3A%22a%22%7D\u0026rb=e HTTP/1.1\r\nHost: furiousexpansion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: http://212.212.104.25\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Wed, 22 Jul 2026 19:28:02 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\naccept-ch: Sec-Ch-Ua-Mobile,X-Ucbrowser-Device-Ua,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version-List,Device-Stock-Ua,X-Device-User-Agent,X-Operamini-Phone-Ua,User-Agent,Sec-Ch-Ua-Full-Version,Sec-Ch-Ua-Platform,Sec-Ch-Ua-Model\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: http://212.212.104.25\r\ncontent-encoding: zstd\r\nset-cookie: uid_id2=019f8b4c-9dea-7595-937f-ec62117795cf:3:1; Path=/; Expires=Wed, 29 Jul 2026 19:28:02 GMT; Secure; SameSite=None\npdhtkv=true; Path=/; Expires=Thu, 23 Jul 2026 19:28:02 GMT; Secure; SameSite=None\nuncs=1; Path=/; Expires=Thu, 23 Jul 2026 19:28:02 GMT; Secure; SameSite=None\npdhtkv49=true; Path=/; Expires=Thu, 23 Jul 2026 19:28:02 GMT; Secure; SameSite=None\nuncs49=1; Path=/; Expires=Thu, 23 Jul 2026 19:28:02 GMT; Secure; SameSite=None\nu_pl27782505=1; Path=/; Expires=Thu, 23 Jul 2026 19:28:02 GMT; Secure; SameSite=None\nnlec2792cc3d21affd98feaab0ce1a771b7b=[5941311]; Path=/; Expires=Wed, 22 Jul 2026 19:28:07 GMT; Secure; SameSite=None\r\nvary: Accept-Encoding\r\nx-envoy-upstream-service-time: 16\r\nHost: furiousexpansion.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: b3cfa2fd75b14637926b26130b087faa\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14704,"size_decoded":11999,"mime_type":"application/json","magic":"JSON text data","md5":"fed4c09230a5cbb771d4fd52ce6d58f5","sha1":"377643a311e29d9d74a0beed8024d63c9c1faefd","sha256":"72e3f1e7a25a311a4fa83e494813793da7d178fb95c3b108d1a668ef1eeaae6b","sha512":"27f1f8cc17af1564abe887016b23484b8e09aba3205a0cbce7531c01ae4f6b3ece017c1bc1724a939b880f0cf98d3dca5520e04eba2d71db07edc69d6a463876","ssdeep":"384:Hu8uiMpn5nVQnq4UtjZHsGp37HIMo7RQUv4atwOeyyG:H7GXynnURBp37voF9v4atyRG","tlshash":"0d62b0be31200c8d1646ffd2109e1de93e191a56dba4eed882bf8ecc1e355130b27355","first_seen":"2026-07-22T19:28:44.625145Z","last_seen":"2026-07-22T19:28:44.625145Z","times_seen":1,"resource_available":false,"data":null}},"time_used":402,"timings":{"blocked":-1,"dns":3,"connect":91,"send":0,"wait":116,"receive":0,"ssl":191},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"furiousexpansion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.google.no/ads/ga-audiences?v=1\u0026t=sr\u0026slf_rd=1\u0026_r=4\u0026ngs=1\u0026ibt=1\u0026tid=G-KC8CB439VM\u0026cid=691017712.1784748483\u0026gtm=45je67l0v9119545805za200zd9119545805\u0026rcb=17\u0026aip=1\u0026dma=1\u0026dma_cps=a\u0026gcd=13l3l3l2l1l1\u0026npa=1\u0026frm=0\u0026tag_exp=115616986~115938466~115938469~118897920~118897930~118981135~119724321~119773332~119896802\u0026z=1664940546","fqdn":"www.google.no","domain":"google.no","tld":"no"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.778Z","timestamp":1784748482778,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.no","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:41:27 GMT","end":"Mon, 21 Sep 2026 08:41:26 GMT"},"fingerprint":{"sha1":"FE:B5:BE:35:CB:DF:57:B9:38:CA:36:5B:8F:BC:13:7C:DE:64:44:66","sha256":"17:D6:B8:5F:85:3E:90:82:55:F6:FF:8B:5F:2E:49:BC:4F:09:E5:AA:B2:2E:E6:F2:31:A1:1E:7E:FC:A0:C4:EC"}}},"request":{"raw":"GET /ads/ga-audiences?v=1\u0026t=sr\u0026slf_rd=1\u0026_r=4\u0026ngs=1\u0026ibt=1\u0026tid=G-KC8CB439VM\u0026cid=691017712.1784748483\u0026gtm=45je67l0v9119545805za200zd9119545805\u0026rcb=17\u0026aip=1\u0026dma=1\u0026dma_cps=a\u0026gcd=13l3l3l2l1l1\u0026npa=1\u0026frm=0\u0026tag_exp=115616986~115938466~115938469~118897920~118897930~118981135~119724321~119773332~119896802\u0026z=1664940546 HTTP/1.1\r\nHost: www.google.no\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\np3p: policyref=\"https://www.googleadservices.com/pagead/p3p.xml\", CP=\"NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC\"\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ndate: Wed, 22 Jul 2026 19:28:04 GMT\r\npragma: no-cache\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\ncache-control: no-cache, no-store, must-revalidate\r\ncontent-type: image/gif\r\nx-content-type-options: nosniff\r\nserver: cafe\r\ncontent-length: 42\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":42,"size_decoded":578,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"d89746888da2d9510b64a9f031eaecd5","sha1":"d5fceb6532643d0d84ffe09c40c481ecdf59e15a","sha256":"ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629","sha512":"d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c","ssdeep":"","tlshash":"c4900023fa808000c3a8c2300a0b238a2b8c80200a28030b80ae208cec3a3a22c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-07-22T21:25:17.152989Z","times_seen":1004493,"resource_available":true,"data":null}},"time_used":1007,"timings":{"blocked":920,"dns":0,"connect":16,"send":0,"wait":39,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ssp.semuadisini.xyz/api/users/517469?host=212.212.104.25\u0026ev=236\u0026wh=1024\u0026ww=1280\u0026uuid=\u0026url=http%3A%2F%2F212.212.104.25%2F\u0026sid=82f6fa0c-9559-418f-ab99-612a45b0b3f7\u0026url=http%3A%2F%2F212.212.104.25%2F","fqdn":"ssp.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"37.27.230.125","port":443,"asn":24940,"as":"Hetzner Online GmbH","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.343Z","timestamp":1784748482343,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"a.nudify.it","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 20 Jul 2026 15:28:45 GMT","end":"Sun, 18 Oct 2026 15:28:44 GMT"},"fingerprint":{"sha1":"95:F5:73:E7:DC:F4:53:09:EB:31:80:CE:05:3A:91:88:3E:50:61:36","sha256":"F9:88:E0:E7:D9:97:33:D2:93:16:51:EA:78:84:C2:43:71:AB:D2:D7:2B:F8:C6:A6:92:42:0B:10:F7:55:5A:74"}}},"request":{"raw":"GET /api/users/517469?host=212.212.104.25\u0026ev=236\u0026wh=1024\u0026ww=1280\u0026uuid=\u0026url=http%3A%2F%2F212.212.104.25%2F\u0026sid=82f6fa0c-9559-418f-ab99-612a45b0b3f7\u0026url=http%3A%2F%2F212.212.104.25%2F HTTP/1.1\r\nHost: ssp.semuadisini.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 19:28:02 GMT\r\ncontent-length: 0\r\nset-cookie: nauid=yNfI65lurmFzzEsPJPzr; Path=/; Expires=Wed, 11 Nov 2037 11:11:11 GMT; Secure; SameSite=None\r\nx-robots-tag: noindex, nofollow\r\ncache-control: private\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":273,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":551,"timings":{"blocked":-1,"dns":0,"connect":14,"send":0,"wait":515,"receive":0,"ssl":22},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ssp.semuadisini.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"flushpersist.com/pxf.gif?uuid=019f8b4c-9dea-7595-937f-ec62117795cf\u0026eb=1042cda5696fe382585e9b1a1b31d927\u0026te=a2214cd5e7362c9cd289b9757c4680da\u0026ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026dev=e\u0026res=14.1053\u0026b_frame=0\u0026pk=0fae9bfe9e7f3facbc02597f741e5aa8\u0026bl=en-US\u0026sr=1024x1280\u0026sz=1024x1280\u0026hjs=19","fqdn":"flushpersist.com","domain":"flushpersist.com","tld":"com"},"ip":{"addr":"172.240.127.234","port":80,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:07.547Z","timestamp":1784748487547,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /pxf.gif?uuid=019f8b4c-9dea-7595-937f-ec62117795cf\u0026eb=1042cda5696fe382585e9b1a1b31d927\u0026te=a2214cd5e7362c9cd289b9757c4680da\u0026ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026dev=e\u0026res=14.1053\u0026b_frame=0\u0026pk=0fae9bfe9e7f3facbc02597f741e5aa8\u0026bl=en-US\u0026sr=1024x1280\u0026sz=1024x1280\u0026hjs=19 HTTP/1.1\r\nHost: flushpersist.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Wed, 22 Jul 2026 19:28:07 GMT\r\nContent-Type: image/gif\r\nContent-Length: 1\r\nConnection: keep-alive\r\naccess-control-allow-origin: *\r\nx-envoy-upstream-service-time: 1\r\nHost: flushpersist.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 9ecc8b19fcc4cdf850a2bf5d3ca875bf\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"flushpersist.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"backupdata.b-cdn.net/padepokan-1.png","fqdn":"backupdata.b-cdn.net","domain":"b-cdn.net","tld":"net"},"ip":{"addr":"138.199.46.65","port":443,"asn":60068,"as":"Datacamp Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.348Z","timestamp":1784748482348,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.b-cdn.net","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 06 Nov 2025 00:00:00 GMT","end":"Wed, 11 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"92:9B:37:29:B4:2D:AB:EB:68:07:7B:03:B2:80:2E:5B:53:CE:AD:E7","sha256":"51:6F:86:36:A1:23:32:72:AA:0F:28:1A:81:F4:92:F8:82:35:42:13:BA:4C:21:2D:80:C5:BB:BF:19:04:1D:32"}}},"request":{"raw":"GET /padepokan-1.png HTTP/1.1\r\nHost: backupdata.b-cdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://212.212.104.25/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 22 Jul 2026 19:28:03 GMT\r\ncontent-type: image/png\r\ncontent-length: 418105\r\nserver: BunnyCDN-SG1-1274\r\ncdn-pullzone: 456355\r\ncdn-requestcountrycode: NO\r\ncache-control: max-age=25600000\r\nlast-modified: Tue, 20 Jan 2026 23:32:12 GMT\r\ncdn-storageserver: DE-634\r\ncdn-fileserver: 1260\r\ncdn-proxyver: 1.43\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 206\r\ncdn-cachedat: 01/20/2026 23:42:52\r\ncdn-edgestorageid: 868\r\ncdn-requestid: 6d3ee3d55513aa12a0a1589326d1c668\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":418105,"size_decoded":418690,"mime_type":"image/png","magic":"PNG image data, 1526 x 234, 8-bit/color RGB, non-interlaced","md5":"79dbb99bd25b44bcdb995aa658c20791","sha1":"349f1c1775d81de9d865817ddc4cc72e7db92c2c","sha256":"4ab88acc9d2aae454bd0e9b6a093647ff817b278c1321bf84dbda19531e68361","sha512":"1c2596f416f0995d446f97ed5bfc4ceeb8c8ca8e8301295953c3787bf14e1707b78e99c8ddf65c884e28bc5f0b82315599acfae24e10f3d49b51590cd04bdc6b","ssdeep":"12288:pJCUu+VaOOBE6Xa5jl8ERrheWrsHOfb+7qgZt/peZ+Co:9CzEca1lR1XsHSaZ6ZBo","tlshash":"0c94235ea5405b338b16f831c1f841b8295bbf2b8be9d1edd1cf3099e12599d847e382","first_seen":"2026-03-08T13:03:07.935201Z","last_seen":"2026-07-22T19:28:44.626477Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1769,"timings":{"blocked":0,"dns":27,"connect":226,"send":0,"wait":758,"receive":378,"ssl":380},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ipv4.icanhazip.com/","fqdn":"ipv4.icanhazip.com","domain":"icanhazip.com","tld":"com"},"ip":{"addr":"104.16.185.241","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cursor.railway.cam/qqtime/qqtime.html","date":"2026-07-22T19:28:17.182Z","timestamp":1784748497182,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"icanhazip.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 12 Jun 2026 10:41:09 GMT","end":"Thu, 10 Sep 2026 11:40:50 GMT"},"fingerprint":{"sha1":"10:E6:6A:24:44:C1:B6:35:30:7E:73:D7:13:17:36:CD:80:F1:80:DC","sha256":"1B:83:2F:AA:4E:58:9B:53:8E:E7:72:97:10:89:CA:50:21:C2:54:C6:32:CE:95:6D:4F:72:C0:9E:2B:86:C6:5A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ipv4.icanhazip.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/plain\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://cursor.railway.cam/\r\nOrigin: https://cursor.railway.cam\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 19:28:17 GMT\r\ncontent-type: text/plain\r\ncontent-length: 15\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\nset-cookie: __cf_bm=fr7dAydLoMwrQOeZGVyA2GyzEND0fpPY0UiK032hK9A-1784748497.1778584-1.0.1.1-utVFkYvfDCEr9Ez5zoDfaXdKDlsTPLnBu.bI7vsdh_2Xcm2V5YHIN6C88u5_Xl4sDFqFUwHDqf3P5K1kBEetieaB2BOVRuhJXDd2RMUNdoixEs56qje48P2wYs_n9y5x; HttpOnly; SameSite=None; Secure; Path=/; Domain=icanhazip.com; Expires=Wed, 22 Jul 2026 19:58:17 GMT\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: a1f4d8fb5dd756bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":15,"size_decoded":628,"mime_type":"text/plain","magic":"ASCII text","md5":"67bca3c725f41cb5088b835a2b6549af","sha1":"a4aad7f09894cd5e75198b1ba595ddf896dafeec","sha256":"3a9b3d658b3171e02d6c1b7200b0f3be0949daf80252e2f38b137fcfde826e06","sha512":"a724055ae57f16bdd3bc10a399578e01825bc5794867648d21b27926cab5d91aafeb047b6fa5c9aaf271678f0ece181a26f0e9bb172e870d06e6871984b3bfef","ssdeep":"","tlshash":"9060008200320a0200800200008000308082028220828c00838822300800000a000030","first_seen":"2025-12-17T23:19:04.362166Z","last_seen":"2026-07-22T19:28:44.627384Z","times_seen":254,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tagivi.com/3/0fae9bfe9e7f3facbc02597f741e5aa8?uidm=019f8b4c-9dea-7595-937f-ec62117795cf_1","fqdn":"tagivi.com","domain":"tagivi.com","tld":"com"},"ip":{"addr":"172.67.208.243","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.346Z","timestamp":1784748482346,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tagivi.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 19 Jul 2026 16:52:57 GMT","end":"Sat, 17 Oct 2026 17:52:51 GMT"},"fingerprint":{"sha1":"EB:03:AE:39:98:D1:E6:52:78:12:1F:F2:8F:E8:64:39:78:C0:2B:B8","sha256":"CB:EB:EE:A5:FB:55:E0:5B:D5:D4:83:21:BB:F9:11:66:4F:A2:17:74:B4:63:78:C7:04:C1:6E:E5:CA:00:FF:9E"}}},"request":{"raw":"GET /3/0fae9bfe9e7f3facbc02597f741e5aa8?uidm=019f8b4c-9dea-7595-937f-ec62117795cf_1 HTTP/1.1\r\nHost: tagivi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: http://212.212.104.25\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nCookie: __cf_bm=D6d6CNXSXiUunn.Zc6Dfv5v94_KN.JkU_puFZ16853M-1784748481.8279684-1.0.1.1-wAWOpHdVT_GBh_BCIB5ys05700C6t8logb4kuveXyBYxL3.KgLMWAgz4HDfLG0Xxgiz4GaBmD6fXWc5SaKEeT5IxPZ2guqInxdRNj6Wd7DqXA.AjV9h93kj2deF0TH4C\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 22 Jul 2026 19:28:02 GMT\r\ncontent-type: text/plain\r\nserver: cloudflare\r\naccept-ch: Sec-Ch-Ua-Mobile,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version,Device-Stock-Ua,X-Device-User-Agent,X-Operamini-Phone-Ua,X-Ucbrowser-Device-Ua,User-Agent,Sec-Ch-Ua-Full-Version-List,Sec-Ch-Ua-Platform,Sec-Ch-Ua-Model\r\nset-cookie: uidm=019f8b4c-9dea-7595-937f-ec62117795cf_1; Path=/; Expires=Sat, 19 Jul 2036 19:28:02 GMT; Secure; SameSite=None\r\nvary: Accept-Encoding, Origin\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\ncache-control: no-cache, max-age=0, private, no-cache\r\nx-request-id: 8bf50d5b2f823ca556217beacf37aef3\r\npragma: no-cache\r\naccess-control-allow-origin: http://212.212.104.25\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,X-Forwarded-For,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\naccess-control-expose-headers: Content-Length,Content-Range\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1728000\r\nstrict-transport-security: max-age=0; includeSubdomains\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: gzip\r\ncf-ray: a1f4d89ebf555a0f-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":76,"size_decoded":1355,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"611fc8f997d0c69caa615b75575c4743","sha1":"37286e993b94afdd4937747036308526a6afbd7b","sha256":"bbf292e0fbd4cbe2faa8aad35f8a1ed2d5cb1830d79bf7533db4f8c171299ddc","sha512":"480b55e27436996fbf1e45b1cb43814b0b1a5ce7dec0e419fde0d2e79d7674567200df2f96d061a9d0f3715ad37d6242c86412cb69fbcef5adb3a3bb86b4a9cd","ssdeep":"","tlshash":"fda0241540cd1d11075004f1301047443037117d0005f1cf70310f077d0f4d04303c03","first_seen":"2026-07-22T19:28:44.627854Z","last_seen":"2026-07-22T19:28:44.627854Z","times_seen":1,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":5,"connect":5,"send":0,"wait":32,"receive":-1,"ssl":10},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tagivi.com/3/0fae9bfe9e7f3facbc02597f741e5aa8?uidm=019f8b4c-9dea-7595-937f-ec62117795cf_1","fqdn":"tagivi.com","domain":"tagivi.com","tld":"com"},"ip":{"addr":"172.67.208.243","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:08.496Z","timestamp":1784748488496,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tagivi.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 19 Jul 2026 16:52:57 GMT","end":"Sat, 17 Oct 2026 17:52:51 GMT"},"fingerprint":{"sha1":"EB:03:AE:39:98:D1:E6:52:78:12:1F:F2:8F:E8:64:39:78:C0:2B:B8","sha256":"CB:EB:EE:A5:FB:55:E0:5B:D5:D4:83:21:BB:F9:11:66:4F:A2:17:74:B4:63:78:C7:04:C1:6E:E5:CA:00:FF:9E"}}},"request":{"raw":"GET /3/0fae9bfe9e7f3facbc02597f741e5aa8?uidm=019f8b4c-9dea-7595-937f-ec62117795cf_1 HTTP/1.1\r\nHost: tagivi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: http://212.212.104.25\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nCookie: __cf_bm=D6d6CNXSXiUunn.Zc6Dfv5v94_KN.JkU_puFZ16853M-1784748481.8279684-1.0.1.1-wAWOpHdVT_GBh_BCIB5ys05700C6t8logb4kuveXyBYxL3.KgLMWAgz4HDfLG0Xxgiz4GaBmD6fXWc5SaKEeT5IxPZ2guqInxdRNj6Wd7DqXA.AjV9h93kj2deF0TH4C; uidm=019f8b4c-9dea-7595-937f-ec62117795cf_1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 22 Jul 2026 19:28:08 GMT\r\ncontent-type: text/plain\r\nserver: cloudflare\r\naccept-ch: Sec-Ch-Ua-Mobile,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version,Device-Stock-Ua,X-Device-User-Agent,X-Operamini-Phone-Ua,X-Ucbrowser-Device-Ua,User-Agent,Sec-Ch-Ua-Full-Version-List,Sec-Ch-Ua-Platform,Sec-Ch-Ua-Model\r\nset-cookie: uidm=019f8b4c-9dea-7595-937f-ec62117795cf_2; Path=/; Expires=Sat, 19 Jul 2036 19:28:08 GMT; Secure; SameSite=None\r\nvary: Accept-Encoding, Origin\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\ncache-control: no-cache, max-age=0, private, no-cache\r\nx-request-id: bd36dc4c4dcbc40c5cbe2403c24fc242\r\npragma: no-cache\r\naccess-control-allow-origin: http://212.212.104.25\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,X-Forwarded-For,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\naccess-control-expose-headers: Content-Length,Content-Range\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1728000\r\nstrict-transport-security: max-age=0; includeSubdomains\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: gzip\r\ncf-ray: a1f4d8c51f805a0f-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":76,"size_decoded":1355,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"c4293187caed420bb50ca5afa730a93e","sha1":"93d8faa25fbe8b298e14e9e8f0896b4ea79f5cd6","sha256":"eb8a78d683f4bba2ba4b91c273e9b45680538caefeb52d54f8fafa06a5a88126","sha512":"571bfd7d73f22e65ce019c5f025527ab2ac192ca5054e4b8e4e0d63e7d40fb629c4a86b105a61f25a027f649d27fd1be5d35554bfb180d3d13e765f9309fdf8a","ssdeep":"","tlshash":"8ba024c3d13d7dc0074d10d313d3700c10154405300037cd01c4c11341543143d40f0f","first_seen":"2026-07-22T19:28:44.628781Z","last_seen":"2026-07-22T19:28:44.628781Z","times_seen":1,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"backupdata.b-cdn.net/padepokan-1.png","fqdn":"backupdata.b-cdn.net","domain":"b-cdn.net","tld":"net"},"ip":{"addr":"138.199.46.65","port":80,"asn":60068,"as":"Datacamp Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:01.877Z","timestamp":1784748481877,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /padepokan-1.png HTTP/1.1\r\nHost: backupdata.b-cdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nDate: Wed, 22 Jul 2026 19:28:02 GMT\r\nContent-Type: text/html\r\nContent-Length: 166\r\nConnection: keep-alive\r\nServer: BunnyCDN-SG1-1274\r\nCDN-PullZone: 456355\r\nCDN-RequestCountryCode: NO\r\nLocation: https://backupdata.b-cdn.net/padepokan-1.png\r\nCDN-RequestId: 3ab5d13cb9a9d57fce2a43d3947eaa72\r\nCDN-RequestTime: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":392,"timings":{"blocked":-1,"dns":24,"connect":183,"send":0,"wait":184,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"portalfluently.com/sfp.js","fqdn":"portalfluently.com","domain":"portalfluently.com","tld":"com"},"ip":{"addr":"185.196.197.72","port":443,"asn":39572,"as":"DataWeb Global Group B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.053Z","timestamp":1784748482053,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"portalfluently.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 10:51:11 GMT","end":"Wed, 16 Sep 2026 10:51:10 GMT"},"fingerprint":{"sha1":"4C:59:13:2E:71:EC:2C:13:DB:DC:E0:9C:09:5F:B6:92:AE:E0:AE:1B","sha256":"7B:33:44:1A:37:E0:26:00:C9:1A:0C:93:61:FF:49:14:7B:7F:82:27:76:99:C7:FE:74:D6:43:5A:20:70:42:F4"}}},"request":{"raw":"GET /sfp.js HTTP/1.1\r\nHost: portalfluently.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Wed, 22 Jul 2026 19:28:02 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: zstd\r\nVary: Accept-Encoding\r\nHost: portalfluently.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 5973776ecb28f45fa2c7c38357ea38fc\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85379,"size_decoded":31055,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators","md5":"b3a5ba94d627e64a77c0e11eaffc96ed","sha1":"f7358693b31e44211dd98b5aa0dc2a3f423286aa","sha256":"600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34","sha512":"64800bcce3e1a65638dfedfe22f205b51725865db3332be95a142e39e4cb40f57358d0c4c01ebb366b8da56aa978b6c7ee992e2c27563bac76c3998014c3d64b","ssdeep":"1536:nPncLBSUBULrSVvTfMtfj3FkdFcE5PnoRC:nPncLBSUBULGVTfGpucE5foM","tlshash":"488395807ac06488d3979b7bb73bf4eaf65a299f38c4044bd100fc48b69562af9f5534","first_seen":"2025-11-18T17:36:30.149277Z","last_seen":"2026-07-22T20:52:10.83211Z","times_seen":23576,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":3,"connect":18,"send":0,"wait":23,"receive":18,"ssl":39},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"portalfluently.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipv4.icanhazip.com/","fqdn":"ipv4.icanhazip.com","domain":"icanhazip.com","tld":"com"},"ip":{"addr":"104.16.185.241","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cursor.railway.cam/qqtime/qqtime.html","date":"2026-07-22T19:28:27.182Z","timestamp":1784748507182,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"icanhazip.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 12 Jun 2026 10:41:09 GMT","end":"Thu, 10 Sep 2026 11:40:50 GMT"},"fingerprint":{"sha1":"10:E6:6A:24:44:C1:B6:35:30:7E:73:D7:13:17:36:CD:80:F1:80:DC","sha256":"1B:83:2F:AA:4E:58:9B:53:8E:E7:72:97:10:89:CA:50:21:C2:54:C6:32:CE:95:6D:4F:72:C0:9E:2B:86:C6:5A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ipv4.icanhazip.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/plain\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://cursor.railway.cam/\r\nOrigin: https://cursor.railway.cam\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 19:28:27 GMT\r\ncontent-type: text/plain\r\ncontent-length: 15\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\nset-cookie: __cf_bm=jrLE4_WKyp_Yq7MVJMr9BlHs6lmeT7hhZp_2t.pNrlI-1784748507.1807556-1.0.1.1-JkOotIr9lgQND3H2txr3Vcime_730ydZoGp9EgzmUTxuzWn3g1Hzgm_PIgb7N.IhPpdfXpSrYUomEY3AXAhjX_9M2WGEgk2_.d3UCiStN2wYb0GI5WsA0Vv3N1UszO4q; HttpOnly; SameSite=None; Secure; Path=/; Domain=icanhazip.com; Expires=Wed, 22 Jul 2026 19:58:27 GMT\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: a1f4d939db9e56bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":15,"size_decoded":628,"mime_type":"text/plain","magic":"ASCII text","md5":"67bca3c725f41cb5088b835a2b6549af","sha1":"a4aad7f09894cd5e75198b1ba595ddf896dafeec","sha256":"3a9b3d658b3171e02d6c1b7200b0f3be0949daf80252e2f38b137fcfde826e06","sha512":"a724055ae57f16bdd3bc10a399578e01825bc5794867648d21b27926cab5d91aafeb047b6fa5c9aaf271678f0ece181a26f0e9bb172e870d06e6871984b3bfef","ssdeep":"","tlshash":"9060008200320a0200800200008000308082028220828c00838822300800000a000030","first_seen":"2025-12-17T23:19:04.362166Z","last_seen":"2026-07-22T19:28:44.627384Z","times_seen":254,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"asset.semuadisini.xyz/wp-content/plugins/pb-seo-friendly-images-pro//assets/js/unveil.js?ver=1.0.0","fqdn":"asset.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:01.872Z","timestamp":1784748481872,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /wp-content/plugins/pb-seo-friendly-images-pro//assets/js/unveil.js?ver=1.0.0 HTTP/1.1\r\nHost: asset.semuadisini.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 19:28:01 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: BunnyCDN-NO1-830\r\nCDN-PullZone: 4107812\r\nCDN-RequestCountryCode: NO\r\nVary: Accept-Encoding, Accept-Encoding\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nAccess-Control-Expose-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nETag: \"632a20d3-6c7\"\r\nExpires: Wed, 22 Jul 2026 22:18:26 GMT\r\nLast-Modified: Tue, 20 Sep 2022 20:21:39 GMT\r\nLink: \u003chttps://sohib21.ink/wp-content/plugins/pb-seo-friendly-images-pro//assets/js/unveil.js?ver=1.0.0\u003e; rel=\"canonical\"\r\nStrict-Transport-Security: max-age=31536000\r\ncdn-proxyver: 1.58\r\nCDN-RequestPullCode: 200\r\nCDN-RequestPullSuccess: True\r\ncdn-edgestorageid: 830\r\nCDN-CachedAt: 07/22/2026 10:18:26\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nCDN-RequestId: b09d52c08cdee688591b48806b35a9dd\r\nCDN-Cache: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":1735,"size_decoded":1889,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"94b9b09987f0b1fb45c27afeeded4935","sha1":"21828dcc8b44a415c747e5393f0fc4e025942e9a","sha256":"0054d12078ff2c32c5cbd742e561e77eb8b856b639438bfa25df52c7183788d9","sha512":"a87b04f12c36ec92868611d8855d98892b5c98aa2dfaaf3a13693e1ec9200ef0170260df8eb9b38ecac6b9292f8a5040e3839670620fb5fe7842be7c0cebb599","ssdeep":"","tlshash":"cd31122d7c6b322228337069cbbfe50a7752803b1904ea44fa0c21909fb5d3d13b5ed9","first_seen":"2023-03-10T10:52:56Z","last_seen":"2026-07-22T19:28:44.63012Z","times_seen":35,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"asset.semuadisini.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"cursor.railway.cam/qqtime/qqtime.html","fqdn":"cursor.railway.cam","domain":"railway.cam","tld":"cam"},"ip":{"addr":"130.94.30.48","port":80,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.298Z","timestamp":1784748482298,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /qqtime/qqtime.html HTTP/1.1\r\nHost: cursor.railway.cam\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nServer: nginx\r\nDate: Wed, 22 Jul 2026 19:28:02 GMT\r\nContent-Type: text/html\r\nContent-Length: 162\r\nConnection: keep-alive\r\nLocation: https://cursor.railway.cam/qqtime/qqtime.html\r\nStrict-Transport-Security: max-age=31536000\r\nAlt-Svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":824,"timings":{"blocked":0,"dns":154,"connect":335,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"cursor.railway.cam","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"cursor.railway.cam","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"cdn.storageimagedisplay.com/si/d8/b1/09/d8b109165fc0ec08002c14fd9e81f6ece67b955e786b918b73abb33e5be5188f.png","fqdn":"cdn.storageimagedisplay.com","domain":"storageimagedisplay.com","tld":"com"},"ip":{"addr":"45.133.44.2","port":80,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.799Z","timestamp":1784748482799,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /si/d8/b1/09/d8b109165fc0ec08002c14fd9e81f6ece67b955e786b918b73abb33e5be5188f.png HTTP/1.1\r\nHost: cdn.storageimagedisplay.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 19:28:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 57237\r\nConnection: keep-alive\r\nServer: nginx/1.21.6\r\nLast-Modified: Sun, 11 May 2025 14:02:30 GMT\r\nETag: \"6820adf6-df95\"\r\nExpires: Fri, 24 Jul 2026 19:28:02 GMT\r\nCache-Control: max-age=172800\r\nX-CDN-Host-ID: AH0543\r\nX-Proxy-Cache: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":57237,"size_decoded":57592,"mime_type":"image/png","magic":"PNG image data, 320 x 240, 8-bit/color RGBA, non-interlaced","md5":"423a240fbfb182d7805dad3bb9e822bb","sha1":"6a853689b2cc95a6c36b98e6938e598bf2a28d52","sha256":"da19475c70c6669a83473eb52dec1feb61e629e374fdd426dd02024080d0b1a6","sha512":"98e063f429420821aa55688891aa4426d16d9e7ffa44f92f8d9d7f3e3870007872a66a718185428f197db14d070b7254e92a2cc7734cc54c39034c808daa7c8f","ssdeep":"1536:BP5oFAaPeX990yL036TelNvY6lEFLXmLw2JR:FWqaPeXz0yLDe7luXyH","tlshash":"ab430224ff03e61784be24af91eae88f1f6421bfb5b092807770221445b7c6b4282463","first_seen":"2025-05-16T16:44:08.672031Z","last_seen":"2026-07-22T20:30:02.809148Z","times_seen":4763,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":1,"connect":19,"send":0,"wait":19,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"furiousexpansion.com/ren.gif?sid=H4sIAAAAAAAC_1xSPYwbRRSedVxBgQgREt0WFCBh3_54vV5SRIqAK4ALIkGRoJpfM_F6Z7OzaztGSDkOIdFdQUG5_nyXi5A4QU0TfHSp2AJ0RU5C1FRIiBL5Yukipnjvzfte8X3vfV8tqjPSRUVPP3jfzHWa0q2o67mv3daZMFPr7txyfa_rXXVv66zfu-rO1qGYvOmHva73urst-chsBZ7veb7nu-_oQioz2zpHofNjP4m6_V7X9wddPwowK_7fsZUDSx2IyRm5DC2aF_5Un0DzFbLxD29JOypN_sbb4yqlpSkwEUcfZaPMTDOML0pVOFDZ0WYaxjaEfNuCyY42KmAmB2sVYLohrZefgGVHG6pgk8OnbFkKmYGJ5zGdrCDTFTRdgZs9aPErAbjAzg1k4wc7ppjSe09RukYb0v7nb-hpQ9pPriAbH19P9cy9adKq1CazmKkaeraCHq6QVyco5y3o6Ql4-QW0IMjGiw60OH3V8xM1YD3eSYSknThKok4SxqojeT_w_ThOIq7Od6PVCtReQmUdVNpBpVqo8hbG4tSlyUCxpN-jiVSxEp4fcxqFYRL3okD1eYSK70KLffDiPvJi96EIYxky3ltQjPQ-rHBgS4KJqA9FagNbPxCprZi_ycEmh_XSlMMFPTTlUGYEtNhHIeoDnd-1e-DlpeVcWbE060BZWS8pE_VSi5KguPuMVur1k04s-qpDgyjq-H2vH6sBkyLgB8qWVb3Iz8iL6zU7R39pjOSpG8RJwHkoAp8qJZKBkpQyj0ufxrHPYgara2jbArUO5roh7w6_Rq4b4nzeAqMnsOkJuHZAKx90WoN-WmOefc-0sSOTB3537SNhauRlG-U9Z5GekZeWH966_uj83B8_vAbJH18r539sH1_5DLyokRc17uhfCIbp7o838lKP9Zyu73-zpKW8BKob8tyj78B1Qy7_vnduxXD7X_D8Pmz-mGwerCFgeQupJkjlRZ-yGvaZP7uoF_ZLDIs2WNpesrRoH7C0SL9pyHv6t3OuDZE_zxsiz36C1aeuJ3rS5wmNYiWjKGJRL-BKMS8OVBgGgwSlbe7QV1b_BQAA__88w797GwQAAA==","fqdn":"furiousexpansion.com","domain":"furiousexpansion.com","tld":"com"},"ip":{"addr":"172.240.127.244","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.810Z","timestamp":1784748482810,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"furiousexpansion.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 21:40:07 GMT","end":"Wed, 23 Sep 2026 21:40:06 GMT"},"fingerprint":{"sha1":"81:6B:A0:BD:75:1F:EB:D5:DD:2D:06:86:4C:AC:44:33:8B:11:5A:CF","sha256":"D9:B3:84:86:0A:17:E7:7F:7A:93:D3:8F:17:B0:68:8F:10:08:3D:85:77:CF:94:4F:10:18:83:B2:FE:C5:1D:80"}}},"request":{"raw":"GET /ren.gif?sid=H4sIAAAAAAAC_1xSPYwbRRSedVxBgQgREt0WFCBh3_54vV5SRIqAK4ALIkGRoJpfM_F6Z7OzaztGSDkOIdFdQUG5_nyXi5A4QU0TfHSp2AJ0RU5C1FRIiBL5Yukipnjvzfte8X3vfV8tqjPSRUVPP3jfzHWa0q2o67mv3daZMFPr7txyfa_rXXVv66zfu-rO1qGYvOmHva73urst-chsBZ7veb7nu-_oQioz2zpHofNjP4m6_V7X9wddPwowK_7fsZUDSx2IyRm5DC2aF_5Un0DzFbLxD29JOypN_sbb4yqlpSkwEUcfZaPMTDOML0pVOFDZ0WYaxjaEfNuCyY42KmAmB2sVYLohrZefgGVHG6pgk8OnbFkKmYGJ5zGdrCDTFTRdgZs9aPErAbjAzg1k4wc7ppjSe09RukYb0v7nb-hpQ9pPriAbH19P9cy9adKq1CazmKkaeraCHq6QVyco5y3o6Ql4-QW0IMjGiw60OH3V8xM1YD3eSYSknThKok4SxqojeT_w_ThOIq7Od6PVCtReQmUdVNpBpVqo8hbG4tSlyUCxpN-jiVSxEp4fcxqFYRL3okD1eYSK70KLffDiPvJi96EIYxky3ltQjPQ-rHBgS4KJqA9FagNbPxCprZi_ycEmh_XSlMMFPTTlUGYEtNhHIeoDnd-1e-DlpeVcWbE060BZWS8pE_VSi5KguPuMVur1k04s-qpDgyjq-H2vH6sBkyLgB8qWVb3Iz8iL6zU7R39pjOSpG8RJwHkoAp8qJZKBkpQyj0ufxrHPYgara2jbArUO5roh7w6_Rq4b4nzeAqMnsOkJuHZAKx90WoN-WmOefc-0sSOTB3537SNhauRlG-U9Z5GekZeWH966_uj83B8_vAbJH18r539sH1_5DLyokRc17uhfCIbp7o838lKP9Zyu73-zpKW8BKob8tyj78B1Qy7_vnduxXD7X_D8Pmz-mGwerCFgeQupJkjlRZ-yGvaZP7uoF_ZLDIs2WNpesrRoH7C0SL9pyHv6t3OuDZE_zxsiz36C1aeuJ3rS5wmNYiWjKGJRL-BKMS8OVBgGgwSlbe7QV1b_BQAA__88w797GwQAAA== HTTP/1.1\r\nHost: furiousexpansion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nCookie: uid_id2=019f8b4c-9dea-7595-937f-ec62117795cf:3:1; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; u_pl27782505=1; nlec2792cc3d21affd98feaab0ce1a771b7b=[5941311]\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Wed, 22 Jul 2026 19:28:03 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccept-ch: Device-Stock-Ua,X-Device-User-Agent,X-Operamini-Phone-Ua,X-Ucbrowser-Device-Ua,Sec-Ch-Ua,User-Agent,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version-List,Sec-Ch-Ua-Full-Version,Sec-Ch-Ua-Platform,Sec-Ch-Ua-Model,Sec-Ch-Ua-Mobile\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\nvary: Origin,Accept-Encoding\r\nx-envoy-upstream-service-time: 3\r\nHost: furiousexpansion.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 20d0e6d5b10ed4478667f4e9a5a57577\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"furiousexpansion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"luugy.com/5/10964410/?oo=1\u0026js_build=iclick-v1.1857.0\u0026userId=h0jq693346pu357179487h3m7cszn955\u0026dmn=llvpn.com\u0026tt=2\u0026ix=0\u0026tspl=1164\u0026cslt=1","fqdn":"luugy.com","domain":"luugy.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.752Z","timestamp":1784748482752,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST /5/10964410/?oo=1\u0026js_build=iclick-v1.1857.0\u0026userId=h0jq693346pu357179487h3m7cszn955\u0026dmn=llvpn.com\u0026tt=2\u0026ix=0\u0026tspl=1164\u0026cslt=1 HTTP/1.1\r\nHost: luugy.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 3300\r\nOrigin: http://212.212.104.25\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"furiousexpansion.com/2d/14/a4/2d14a44f41adef437409b332dde956fc.js","fqdn":"furiousexpansion.com","domain":"furiousexpansion.com","tld":"com"},"ip":{"addr":"172.240.127.244","port":80,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.336Z","timestamp":1784748482336,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /2d/14/a4/2d14a44f41adef437409b332dde956fc.js HTTP/1.1\r\nHost: furiousexpansion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Wed, 22 Jul 2026 19:28:02 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\naccept-ch: Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version-List,Sec-Ch-Ua-Model,Device-Stock-Ua,X-Device-User-Agent,User-Agent,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua,Sec-Ch-Ua-Full-Version,Sec-Ch-Ua-Platform,Sec-Ch-Ua-Mobile,X-Operamini-Phone-Ua,X-Ucbrowser-Device-Ua\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nx-envoy-upstream-service-time: 8\r\nHost: furiousexpansion.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 30284a514cf906426fc481ce6ddc7b63\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31132,"size_decoded":11218,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (31132), with no line terminators","md5":"0c22f41561961ff8f54c796956180950","sha1":"775cd694936c5b713ca85ab5c5070582f21739a1","sha256":"1bcb234d9c5409ede8f9cb83846b4d9effc8ece3f7dda5d8861e4b3548bc9f82","sha512":"0cc7b928bdf5c85491b2f3a9f10d6f83219dd29ea77d225a4613622323a1873bf5a18c5ecf515f4fa01f456343fd6029ffd027486e62e21f57eb065a9a426fbb","ssdeep":"384:pahiQJGjwKVhnbuueU87S0sTiRl6oBZxmeEWrg6ZOFgmR/07FZqXZ5:CiQJehQR9b4/WrxOFgXB4X/","tlshash":"fae26458bb92f8580293e0b6353fc01bf51a48517becd0a4e596d5fc2e79648f732b18","first_seen":"2026-07-22T19:28:44.63167Z","last_seen":"2026-07-22T19:28:44.63167Z","times_seen":1,"resource_available":true,"data":null}},"time_used":195,"timings":{"blocked":-1,"dns":1,"connect":91,"send":0,"wait":103,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"furiousexpansion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"backupdata.b-cdn.net/image/logo-lk21.png","fqdn":"backupdata.b-cdn.net","domain":"b-cdn.net","tld":"net"},"ip":{"addr":"138.199.46.65","port":80,"asn":60068,"as":"Datacamp Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:03.935Z","timestamp":1784748483935,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /image/logo-lk21.png HTTP/1.1\r\nHost: backupdata.b-cdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nDate: Wed, 22 Jul 2026 19:28:04 GMT\r\nContent-Type: text/html\r\nContent-Length: 166\r\nConnection: keep-alive\r\nServer: BunnyCDN-SG1-1274\r\nCDN-PullZone: 456355\r\nCDN-RequestCountryCode: NO\r\nLocation: https://backupdata.b-cdn.net/image/logo-lk21.png\r\nCDN-RequestId: 204389865ab5e0c55a1ba2d9277c5f56\r\nCDN-RequestTime: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":1113,"timings":{"blocked":929,"dns":0,"connect":0,"send":0,"wait":184,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"backupdata.b-cdn.net/image/logo-lk21.png","fqdn":"backupdata.b-cdn.net","domain":"b-cdn.net","tld":"net"},"ip":{"addr":"138.199.46.65","port":443,"asn":60068,"as":"Datacamp Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:05.261Z","timestamp":1784748485261,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.b-cdn.net","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 06 Nov 2025 00:00:00 GMT","end":"Wed, 11 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"92:9B:37:29:B4:2D:AB:EB:68:07:7B:03:B2:80:2E:5B:53:CE:AD:E7","sha256":"51:6F:86:36:A1:23:32:72:AA:0F:28:1A:81:F4:92:F8:82:35:42:13:BA:4C:21:2D:80:C5:BB:BF:19:04:1D:32"}}},"request":{"raw":"GET /image/logo-lk21.png HTTP/1.1\r\nHost: backupdata.b-cdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://212.212.104.25/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 22 Jul 2026 19:28:05 GMT\r\ncontent-type: image/png\r\ncontent-length: 627\r\nserver: BunnyCDN-SG1-1274\r\ncdn-pullzone: 456355\r\ncdn-requestcountrycode: NO\r\ncache-control: max-age=25600000\r\nlast-modified: Sat, 22 Feb 2025 03:51:06 GMT\r\ncdn-storageserver: DE-587\r\ncdn-fileserver: 644\r\ncdn-proxyver: 1.32\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 206\r\ncdn-cachedat: 07/21/2025 11:01:54\r\ncdn-edgestorageid: 1274\r\ncdn-requestid: e61a694e4a4faf19610d56fba67bc5b7\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":627,"size_decoded":1209,"mime_type":"image/png","magic":"PNG image data, 28 x 28, 8-bit colormap, non-interlaced","md5":"c4fa6dfc55729cd5abb01f317ff363f4","sha1":"2720b662e4f41898f75f4975f6f92be9020c515b","sha256":"eff7bd5a269aaecdfcf3c1217062a0239f20f4ea723f51ba6ab7971a7e63fc98","sha512":"6c0166bd6fdc6c525c84d59f26205db95b8b8650f7b58354a3ccdd61a5c62655756b6e62c85afbadfdb3941b25d6c1e7dbce5b280b87af234f2064081bc99e73","ssdeep":"","tlshash":"a4f068742d3c87b6d496bfa185cef042c57049b63e51c8c80474d1581f7255031e60c2","first_seen":"2025-11-21T08:40:54.612506Z","last_seen":"2026-07-22T19:28:44.632646Z","times_seen":2,"resource_available":false,"data":null}},"time_used":176,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":176,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"212.212.104.25/","fqdn":"212.212.104.25","domain":"212.212.104.25","tld":""},"ip":{"addr":"212.212.104.25","port":80,"asn":3257,"as":"GTT Communications Inc.","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-22T19:28:01.307Z","timestamp":1784748481307,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 212.212.104.25\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 22 Jul 2026 19:28:01 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding\r\nCDN-PullZone: 6042775\r\nCDN-RequestCountryCode: FR\r\nCache-Control: no-cache\r\nSet-Cookie: bunny_shield_id_153462=ef40376cd06b4412966ec7faf596470e; path=/; secure; httponly\r\nStrict-Transport-Security: max-age=31536000\r\nCDN-ProxyVer: 1.58\r\nCDN-RequestPullSuccess: True\r\nCDN-RequestPullCode: 200\r\nCDN-CachedAt: 07/22/2026 07:10:19\r\nCDN-EdgeStorageId: 1127\r\nCDN-RequestId: fd11accf3e80177045f12055066c35bb\r\nCDN-Cache: EXPIRED\r\nCDN-Status: 200\r\nCDN-RequestTime: 0\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Redis","description":"Redis is an in-memory data structure project implementing a distributed, in-memory key–value database with optional durability. Redis supports different kinds of abstract data structures, such as strings, lists, maps, sets, sorted sets, HyperLogLogs, bitmaps, streams, and spatial indexes.","website":"https://redis.io","common_platform_enumeration":"cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*","icon":"Redis.svg","categories":["Databases"]},{"name":"Redis Object Cache","description":"","website":"https://wprediscache.com","common_platform_enumeration":"","icon":"RedisObjectCache.svg","categories":["Caching"]},{"name":"WP Fastest Cache","description":"WP Fastest Cache is one of a number of plugins for WordPress designed to accelerate the performance of your website.","website":"https://www.wpfastestcache.com","common_platform_enumeration":"","icon":"WP Fastest Cache.png","categories":["WordPress plugins","Performance"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":204154,"size_decoded":28514,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (6002)","md5":"45b2d5a7a0a520e71b8af9ada4a7fc46","sha1":"39af43d7850640bca7da2578c6d35de98dfed257","sha256":"2e6ba9a1e649b42a0f0084dd226eba45a419554927b3d6b6dddc6b96b369cce2","sha512":"1953fd9999ac7f3d29b11cbff8bc88b37bfbbbe3261a1c08ec9346ef3e145441f71b517d75bf9de69ea33cd9ff9970dd31b042ac6d6701b36cc3cbedf4915a74","ssdeep":"3072:Lj3WL4+op5XoZ6tCxjI1h+yQC6ptargztVPasDgApDm10pg:f3O4DoZ6tCxjIZaP/Dm","tlshash":"1914b8bad0682e360dd6feb2f6907b55f4811592caa15823a7f9df0a37c0dc0b572709","first_seen":"2026-07-22T19:28:44.633619Z","last_seen":"2026-07-22T19:28:44.633619Z","times_seen":1,"resource_available":true,"data":null}},"time_used":171,"timings":{"blocked":-1,"dns":0,"connect":42,"send":0,"wait":87,"receive":42,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"ssp.semuadisini.xyz/41T7ql3.js","fqdn":"ssp.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"37.27.230.125","port":80,"asn":24940,"as":"Hetzner Online GmbH","country":"Finland","country_code":"FI"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:01.862Z","timestamp":1784748481862,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /41T7ql3.js HTTP/1.1\r\nHost: ssp.semuadisini.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 22 Jul 2026 19:28:01 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 56361\r\nConnection: keep-alive\r\nlast-modified: Fri, 03 Jul 2026 08:04:39 GMT\r\nvary: Accept-Encoding\r\netag: \"6a476d17-dc29\"\r\ncontent-encoding: gzip\r\nexpires: Tue, 21 Jul 2026 01:40:49 GMT\r\nCache-Control: public, max-age=86400\r\nAge: 20208\r\ncf-cache-status: HIT\r\nCF-RAY: a1e02ff2f8e83017-ARN\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":187138,"size_decoded":56797,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65498), with no line terminators","md5":"3f940965fcf68e23574d12017f10dbc6","sha1":"f44d863dc3bb6a666f8fe48a139b7ebea7cd3cec","sha256":"a08251f6fb9799532b51140534879addcdf180e05875852b67eca9868728a856","sha512":"4d4d24a4e1f832828f087cc8779fb55a5801c159483b49734576077091cafee50eafb5b90f6ea492bfbb619af7a165c048a023e3a2274df5b78f4040139bac0e","ssdeep":"1536:tIRGSJpE+unOJKBuLq6GkarC1K744dPOvYmJou4X/6qIzBOykczQsVdU14OulNgU:t7SJPuPuLHtQdPM1xznZMtDc","tlshash":"9b04958dbac1b15106a36164062f141af27b3a94b44ec480f66dd5d16fbae0fac77e2c","first_seen":"2026-07-03T08:30:14.213621Z","last_seen":"2026-07-22T20:42:18.817166Z","times_seen":122,"resource_available":true,"data":null}},"time_used":168,"timings":{"blocked":-1,"dns":85,"connect":14,"send":0,"wait":27,"receive":42,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"ssp.semuadisini.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"cdn.storageimagedisplay.com/cti/58/b9/7d/58b97d2a70e2a7273a46424bd5aeed80/1779963470.png","fqdn":"cdn.storageimagedisplay.com","domain":"storageimagedisplay.com","tld":"com"},"ip":{"addr":"45.133.44.2","port":80,"asn":39572,"as":"DataWeb Global Group B.V.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.800Z","timestamp":1784748482800,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /cti/58/b9/7d/58b97d2a70e2a7273a46424bd5aeed80/1779963470.png HTTP/1.1\r\nHost: cdn.storageimagedisplay.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 19:28:02 GMT\r\nContent-Type: image/png\r\nContent-Length: 136772\r\nConnection: keep-alive\r\nServer: nginx/1.21.6\r\nLast-Modified: Thu, 28 May 2026 10:17:50 GMT\r\nETag: \"6a18164e-21644\"\r\nExpires: Fri, 24 Jul 2026 19:28:02 GMT\r\nCache-Control: max-age=172800\r\nX-CDN-Host-ID: AH0543\r\nX-Proxy-Cache: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.21.6","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136772,"size_decoded":137129,"mime_type":"image/png","magic":"PNG image data, 320 x 240, 8-bit/color RGB, non-interlaced","md5":"43a46225a4b1255bba7b93272a30553d","sha1":"d2c3ac65ad5bf46c2e2e39c7765783df8c7d6296","sha256":"0d0ef378cd0ff7ef55e51834a5f6d167f963aef15bbdf5a0dc711fb5517a9bf5","sha512":"71ab59cd41dffba09c7d203b3eaa88b4892325e4af8ba84f6edc73b7e099c4ea6a93c8b72a5ae143ca91c183642c792ce67d464612ee5a167aabfd9160c0af3c","ssdeep":"3072:TkYTANLJvIwFFbUKky5xiv4hs3SmLcTSpoch+k5:IYcNLFISFbUKL1hrmYTS2q9","tlshash":"fcd313a0dbaa417fb1e4da67422530df7d80a17f3e8948b19b8ad1940395f5cd3d93c1","first_seen":"2026-05-30T12:27:27.240422Z","last_seen":"2026-07-22T19:28:44.635014Z","times_seen":9,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":19,"send":0,"wait":19,"receive":73,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"asset.semuadisini.xyz/wp-content/uploads/2025/11/lk21-indoxxi-min.png","fqdn":"asset.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:01.874Z","timestamp":1784748481874,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /wp-content/uploads/2025/11/lk21-indoxxi-min.png HTTP/1.1\r\nHost: asset.semuadisini.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 19:28:01 GMT\r\nContent-Type: image/png\r\nContent-Length: 4562\r\nConnection: keep-alive\r\nServer: BunnyCDN-NO1-830\r\nCDN-PullZone: 4107812\r\nCDN-RequestCountryCode: NO\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nAccess-Control-Expose-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nCache-Control: max-age=2592000\r\nETag: \"69165be8-11d2\"\r\nExpires: Sun, 16 Aug 2026 20:26:04 GMT\r\nLast-Modified: Thu, 13 Nov 2025 22:30:00 GMT\r\nStrict-Transport-Security: max-age=31536000\r\ncdn-proxyver: 1.58\r\nCDN-RequestPullCode: 200\r\nCDN-RequestPullSuccess: True\r\ncdn-edgestorageid: 830\r\nCDN-CachedAt: 07/17/2026 20:26:04\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nCDN-RequestId: 5feb5d477ae276c079a9c618827257f6\r\nCDN-Cache: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":4562,"size_decoded":5538,"mime_type":"image/png","magic":"PNG image data, 170 x 70, 8-bit colormap, non-interlaced","md5":"bc371e4698d0e86256337218a0d59bba","sha1":"a8f4cb19a19f78b496db2773afd1b67939951ebb","sha256":"b02d05d80f7d73f3cf0fb894bb77a9bff20a7a39d9de8401a467d8d67242b25d","sha512":"8d541069a92be10a737b637b5e02e91e08a7963a68f162c1267f540fb9ff08037eed8de9d50b0b4d8f6ce71987952fc2f7c63b0845e9996cf8576e6bf1247faa","ssdeep":"96:hXDUnufF2cc2lVWh1EpXjWic5S/Db4VIHgAVTGiWC9Zdn1:JUny7c2c1Bic5iHgnih1","tlshash":"15916c57e9040eeb1c6e21c5a1cd25bb16f27058fcd2a57eea088690a823b68d5d2438","first_seen":"2025-11-21T08:40:54.639009Z","last_seen":"2026-07-22T19:28:44.635644Z","times_seen":5,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"asset.semuadisini.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipv4.icanhazip.com/","fqdn":"ipv4.icanhazip.com","domain":"icanhazip.com","tld":"com"},"ip":{"addr":"104.16.185.241","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cursor.railway.cam/qqtime/qqtime.html","date":"2026-07-22T19:28:07.186Z","timestamp":1784748487186,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"icanhazip.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 12 Jun 2026 10:41:09 GMT","end":"Thu, 10 Sep 2026 11:40:50 GMT"},"fingerprint":{"sha1":"10:E6:6A:24:44:C1:B6:35:30:7E:73:D7:13:17:36:CD:80:F1:80:DC","sha256":"1B:83:2F:AA:4E:58:9B:53:8E:E7:72:97:10:89:CA:50:21:C2:54:C6:32:CE:95:6D:4F:72:C0:9E:2B:86:C6:5A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ipv4.icanhazip.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/plain\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://cursor.railway.cam/\r\nOrigin: https://cursor.railway.cam\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 22 Jul 2026 19:28:07 GMT\r\ncontent-type: text/plain\r\ncontent-length: 15\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\nset-cookie: __cf_bm=ouMIbnRTeQNWJTRgtBobpSdanwXgHoQhUD48EkCxg6k-1784748487.202755-1.0.1.1-62KUFpv9tT0EuG_GkHI6Ila62n.QanRZ_qqS3PoZPiMPpFxXPoXYimc0ki2fCg4GfXB2lWEJQ9thEw6bUa7l9u6JxvHzCs99ACCdroQxRSJv5UnS9VuJjV_9BscgUbLw; HttpOnly; SameSite=None; Secure; Path=/; Domain=icanhazip.com; Expires=Wed, 22 Jul 2026 19:58:07 GMT\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: a1f4d8bd091656bd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":15,"size_decoded":627,"mime_type":"text/plain","magic":"ASCII text","md5":"67bca3c725f41cb5088b835a2b6549af","sha1":"a4aad7f09894cd5e75198b1ba595ddf896dafeec","sha256":"3a9b3d658b3171e02d6c1b7200b0f3be0949daf80252e2f38b137fcfde826e06","sha512":"a724055ae57f16bdd3bc10a399578e01825bc5794867648d21b27926cab5d91aafeb047b6fa5c9aaf271678f0ece181a26f0e9bb172e870d06e6871984b3bfef","ssdeep":"","tlshash":"9060008200320a0200800200008000308082028220828c00838822300800000a000030","first_seen":"2025-12-17T23:19:04.362166Z","last_seen":"2026-07-22T19:28:44.627384Z","times_seen":254,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":3,"connect":17,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"asset.semuadisini.xyz/wp-content/cache/wpfc-minified/2fryawkk/4e5ln.css","fqdn":"asset.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:01.823Z","timestamp":1784748481823,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /wp-content/cache/wpfc-minified/2fryawkk/4e5ln.css HTTP/1.1\r\nHost: asset.semuadisini.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 19:28:01 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: BunnyCDN-NO1-830\r\nCDN-PullZone: 4107812\r\nCDN-RequestCountryCode: NO\r\nVary: Accept-Encoding, Accept-Encoding\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nAccess-Control-Expose-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nETag: \"6a59b065-12ed4\"\r\nExpires: Tue, 21 Jul 2026 08:49:55 GMT\r\nLast-Modified: Fri, 17 Jul 2026 04:32:37 GMT\r\nLink: \u003chttps://sohib21.ink/wp-content/cache/wpfc-minified/2fryawkk/4e5ln.css\u003e; rel=\"canonical\"\r\nStrict-Transport-Security: max-age=31536000\r\ncdn-proxyver: 1.58\r\nCDN-RequestPullCode: 200\r\nCDN-RequestPullSuccess: True\r\ncdn-edgestorageid: 830\r\nCDN-CachedAt: 07/22/2026 09:22:15\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nCDN-RequestId: 498d278987f5bfd991be0e194340dce1\r\nCDN-Cache: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":77524,"size_decoded":18971,"mime_type":"text/css","magic":"ASCII text, with very long lines (4895)","md5":"2236c6885e036c757b41646bf9e4c322","sha1":"fe45780b39e4c7fc263208f2e2019fa2840f1be5","sha256":"44052a914a724f3b6b7eda18ad89f258834b5d326728e0777a9e06c6e26f07bc","sha512":"f0cd77d8d972630876e5ffb11a9d72bfde6b3790026be2f9f212d4f17428fc3a905deb9c4fd372f8129a936c41f0a6e87f911c88f0143f2e3e39c39add687444","ssdeep":"1536:H8veE8v1srRNl2ywrpx94GSFRAte2ua3gSczh34tGAe6pjoJXHY+DipOx:p1srRNl6rpx93ERUe2utzhIMAxpjoJXB","tlshash":"7373f85765402808b23bd2a6bce2a765373d8503e31b29fda199b418c3ce9d545b3bcf","first_seen":"2025-04-16T03:23:59.326961Z","last_seen":"2026-07-22T19:28:44.636522Z","times_seen":8,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":67,"connect":1,"send":0,"wait":3,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"asset.semuadisini.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"asset.semuadisini.xyz/wp-content/themes/muvipro/js/customscript.js?ver=2.1.9","fqdn":"asset.semuadisini.xyz","domain":"semuadisini.xyz","tld":"xyz"},"ip":{"addr":"194.242.11.186","port":80,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:01.867Z","timestamp":1784748481867,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /wp-content/themes/muvipro/js/customscript.js?ver=2.1.9 HTTP/1.1\r\nHost: asset.semuadisini.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 19:28:01 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: BunnyCDN-NO1-830\r\nCDN-PullZone: 4107812\r\nCDN-RequestCountryCode: NO\r\nVary: Accept-Encoding, Accept-Encoding\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nAccess-Control-Expose-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\nCache-Control: max-age=43200\r\nContent-Encoding: gzip\r\nETag: \"67d4b6f3-1803\"\r\nExpires: Tue, 21 Jul 2026 20:55:36 GMT\r\nLast-Modified: Fri, 14 Mar 2025 23:08:35 GMT\r\nLink: \u003chttps://sohib21.ink/wp-content/themes/muvipro/js/customscript.js?ver=2.1.9\u003e; rel=\"canonical\"\r\nStrict-Transport-Security: max-age=31536000\r\ncdn-proxyver: 1.58\r\nCDN-RequestPullCode: 200\r\nCDN-RequestPullSuccess: True\r\ncdn-edgestorageid: 830\r\nCDN-CachedAt: 07/22/2026 09:32:06\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nCDN-RequestId: 0c06d76ae57ccf7c9a87a442fb70e095\r\nCDN-Cache: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":6147,"size_decoded":3063,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (510)","md5":"b246ea22dea584dd0bdf855515f3b701","sha1":"55767474c10d08255b1876f70f4e758985aecbef","sha256":"1c6f518eeb52ac428e414991cc7536284312c34763cb9e385271e63c48cddaab","sha512":"7aaed7a85748719cc39a2711216fc9245290110c700fb01e4233856f4fd3591ce28a7da5d36408278a49b4d4cb8203242ed33ac1089dc92f4f25b30916247745","ssdeep":"96:p4lr12ykxw9iTSIgc92b51YeVO7kvwKeOk1s00mnan10O/1iXgBy2LibUFLi3s89:Cr1Pk0ieVcixsxG73QgBtio9icCHh","tlshash":"d3c153d9f72c053740f732dbe9ad96dc747d40a7a504042b7c78d86829a4c9920bafe9","first_seen":"2023-03-07T01:19:38Z","last_seen":"2026-07-22T19:28:44.637468Z","times_seen":210,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":23,"connect":1,"send":0,"wait":2,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"asset.semuadisini.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-KC8CB439VM","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.287Z","timestamp":1784748482287,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:37:33 GMT","end":"Mon, 21 Sep 2026 08:37:32 GMT"},"fingerprint":{"sha1":"85:82:80:E9:F0:BC:08:B5:D8:5D:91:B4:E5:D3:DB:B1:A7:2F:E3:F3","sha256":"E3:94:E9:DA:2C:F1:36:09:33:63:D3:69:08:E7:E6:91:8D:F3:61:7F:0F:D0:5F:8E:B6:E9:D7:F3:DD:10:3C:DC"}}},"request":{"raw":"GET /gtag/js?id=G-KC8CB439VM HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://212.212.104.25/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ndate: Wed, 22 Jul 2026 19:28:02 GMT\r\nexpires: Wed, 22 Jul 2026 19:28:02 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 172400\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":511682,"size_decoded":173004,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (7830)","md5":"e3db4d0446f7e234db67b0409ec9dbbe","sha1":"f9a0fe05bed8429aec80d6791201c0fcb6ce4b00","sha256":"74e5e645fbeced364d93967ea0b46ea72cd3e2749dcbbddcd7f6af899f846691","sha512":"974593658e7018ea02c250a4cc926ddb0a4fca5ac7cb10279c5fb453fd32f8170c46bc3233f2df3777c3fd985477f747679eb89ab8afb952942734c52046d907","ssdeep":"6144:/P72yc1/T/I0t9RlGYYwqY5T+cMz9d0C3TnHfbcx+OfxPmX2e:n7OTxMjbcFZOp","tlshash":"23b40aceb3d674225396f478503f01cba97b29e2b49cc89ab189cce02e745568177f78","first_seen":"2026-07-22T19:28:44.638657Z","last_seen":"2026-07-22T19:28:44.638657Z","times_seen":1,"resource_available":true,"data":null}},"time_used":149,"timings":{"blocked":-1,"dns":0,"connect":17,"send":0,"wait":37,"receive":60,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"backupdata.b-cdn.net/duitsbalisk.png","fqdn":"backupdata.b-cdn.net","domain":"b-cdn.net","tld":"net"},"ip":{"addr":"138.199.46.65","port":443,"asn":60068,"as":"Datacamp Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.352Z","timestamp":1784748482352,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.b-cdn.net","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 06 Nov 2025 00:00:00 GMT","end":"Wed, 11 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"92:9B:37:29:B4:2D:AB:EB:68:07:7B:03:B2:80:2E:5B:53:CE:AD:E7","sha256":"51:6F:86:36:A1:23:32:72:AA:0F:28:1A:81:F4:92:F8:82:35:42:13:BA:4C:21:2D:80:C5:BB:BF:19:04:1D:32"}}},"request":{"raw":"GET /duitsbalisk.png HTTP/1.1\r\nHost: backupdata.b-cdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://212.212.104.25/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 22 Jul 2026 19:28:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 466514\r\nserver: BunnyCDN-SG1-1274\r\ncdn-pullzone: 456355\r\ncdn-requestcountrycode: NO\r\ncache-control: max-age=25600000\r\nlast-modified: Wed, 04 Feb 2026 05:17:55 GMT\r\ncdn-storageserver: DE-1139\r\ncdn-fileserver: 995\r\ncdn-proxyver: 1.43\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 206\r\ncdn-cachedat: 02/04/2026 05:20:40\r\ncdn-edgestorageid: 1274\r\ncdn-requestid: 959553e45187adae6a5fb48955162f05\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":466514,"size_decoded":467100,"mime_type":"image/png","magic":"PNG image data, 1534 x 240, 8-bit/color RGB, non-interlaced","md5":"519d798a70dac2411a18d54576691944","sha1":"11137e1762fcce2a53ea500c0ec1614fdc9ebac6","sha256":"6a3d3edf7bf5f8b509be997a2605a17f959e5d4ff701b61969eb820e477ae68b","sha512":"c429f7ebf44fdeaae99d472bd137522e49a811cd12d101ca4a5dd950b65cae3cb6942910cfb7fffb8bb64a090c52862102db3cf8a79c36f9ed7a6a7bcc311e5c","ssdeep":"12288:GtJbXDG2ZM0Pfo5i1V/nPvTETTu+NPedB7AAj/Gxlvd:abqkpEi1V/PvTEbV4CTvd","tlshash":"c7a42399bd3be8ceb79f9bc8869004147484eb463ef31280b0d76bf95901f4d476a364","first_seen":"2026-03-08T13:03:07.95045Z","last_seen":"2026-07-22T19:28:44.639521Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1735,"timings":{"blocked":0,"dns":24,"connect":201,"send":0,"wait":178,"receive":970,"ssl":362},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cursor.railway.cam/qqtime/34ef644ff217a50beadde64dc8e23a7d.js","fqdn":"cursor.railway.cam","domain":"railway.cam","tld":"cam"},"ip":{"addr":"130.94.30.48","port":443,"asn":2914,"as":"NTT-LTD-2914","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cursor.railway.cam/qqtime/qqtime.html","date":"2026-07-22T19:28:04.514Z","timestamp":1784748484514,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cursor.railway.cam","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 19:15:08 GMT","end":"Thu, 01 Oct 2026 19:15:07 GMT"},"fingerprint":{"sha1":"61:00:91:A8:21:A7:F7:68:B6:EF:D6:85:2C:0E:94:F5:E6:CD:E7:CB","sha256":"09:EA:9D:A4:AF:F2:5C:CF:B3:52:44:F4:3E:BE:D5:7A:4F:AA:63:96:DF:4A:66:63:A9:D6:3B:14:39:C1:F3:A4"}}},"request":{"raw":"GET /qqtime/34ef644ff217a50beadde64dc8e23a7d.js HTTP/1.1\r\nHost: cursor.railway.cam\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cursor.railway.cam/qqtime/qqtime.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 22 Jul 2026 19:28:04 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 11 Jul 2026 16:13:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a526bb2-c5f1\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":50673,"size_decoded":22488,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (50670), with no line terminators","md5":"e8c43e2c16114e66cdd70b80ac84c824","sha1":"6fe725ad2cf8df011e6a6b4cbe259fbe4d33e23a","sha256":"327de4be0b8b768c4354ac9bcb3957f7c3712bf76e85198ca927ae4e9fceb119","sha512":"d4068fd99d83e888791e72b2144efe1afa501cbb8c749a1eaea950b0941dd860ea82f53efaf638c62b7854542dc5334a9169b3bcd26522641b9c2eb10f4aa38e","ssdeep":"768:gM3zThFJqWx7EyYPWtBBYBS/8XuxzddhycF45cNR83V4VJwCB39E/ynXGX/9aM7:Hz9qQEyruiDyTcNaKldXGL","tlshash":"8f337deea38026dc5cb4cce7a53706ad63f8db076c14326db38bae91b45f7109950729","first_seen":"2026-07-22T19:28:44.640695Z","last_seen":"2026-07-22T19:28:44.640695Z","times_seen":1,"resource_available":true,"data":null}},"time_used":651,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":651,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"cursor.railway.cam","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"cursor.railway.cam","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipsadminuser.shop/api/ip-sync/sync","fqdn":"ipsadminuser.shop","domain":"ipsadminuser.shop","tld":"shop"},"ip":{"addr":"172.67.205.92","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cursor.railway.cam/qqtime/qqtime.html","date":"2026-07-22T19:28:17.199Z","timestamp":1784748497199,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipsadminuser.shop","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 23 Jun 2026 18:20:42 GMT","end":"Mon, 21 Sep 2026 18:20:41 GMT"},"fingerprint":{"sha1":"9B:DF:EE:39:98:FB:B8:1F:A6:1E:E4:B8:13:3D:90:3B:F1:FB:0C:4C","sha256":"94:57:B8:50:98:AB:A7:AE:B7:29:CD:4D:D6:4C:E5:6F:7B:1A:5B:63:FC:33:A8:29:55:0A:29:30:C5:0E:07:5C"}}},"request":{"raw":"OPTIONS /api/ip-sync/sync HTTP/1.1\r\nHost: ipsadminuser.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://cursor.railway.cam/\r\nOrigin: https://cursor.railway.cam\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 19:28:17 GMT\r\nserver-timing: cfExtPri\r\nset-cookie: bt_route=3d2205ef087b8aa44ccb9272f5894457; Expires=Thu, 23-Jul-2026 07:28:17 GMT; Path=/; HttpOnly\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://cursor.railway.cam\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: content-type\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hzkxQYTkeNTZwyO4rmBLBO8%2Bzz38WK4NAd373i8P%2BvM0IEVRRM28oSHrFv%2FypPPWE0q5aImTNCtoi7fCcAJmnD49hRTqtgX9Z%2FLhpOrByfdpwRVLACd4xVY1OoXsnO%2BVpFv9iQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: a1f4d8fb7b3956c6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":1039,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":204,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":204,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"tagivi.com/0f/ae/9b/0fae9bfe9e7f3facbc02597f741e5aa8.js?mg=1","fqdn":"tagivi.com","domain":"tagivi.com","tld":"com"},"ip":{"addr":"172.67.208.243","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:01.828Z","timestamp":1784748481828,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /0f/ae/9b/0fae9bfe9e7f3facbc02597f741e5aa8.js?mg=1 HTTP/1.1\r\nHost: tagivi.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 22 Jul 2026 19:28:01 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nSet-Cookie: uidm=019f8b4c-9d3f-7a49-a106-fbaedb38fdf8_1; Path=/; Expires=Sat, 19 Jul 2036 19:28:01 GMT; Secure; SameSite=None\n__cf_bm=D6d6CNXSXiUunn.Zc6Dfv5v94_KN.JkU_puFZ16853M-1784748481.8279684-1.0.1.1-wAWOpHdVT_GBh_BCIB5ys05700C6t8logb4kuveXyBYxL3.KgLMWAgz4HDfLG0Xxgiz4GaBmD6fXWc5SaKEeT5IxPZ2guqInxdRNj6Wd7DqXA.AjV9h93kj2deF0TH4C; HttpOnly; Path=/; Domain=tagivi.com; Expires=Wed, 22 Jul 2026 19:58:01 GMT\r\nAccept-Ch: Sec-Ch-Ua-Mobile,Device-Stock-Ua,X-Device-User-Agent,X-Operamini-Phone-Ua,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version-List,Sec-Ch-Ua-Platform,X-Ucbrowser-Device-Ua,User-Agent,Sec-Ch-Ua,Sec-Ch-Ua-Full-Version,Sec-Ch-Ua-Model\r\nContent-Encoding: gzip\r\nLink: \u003chttps://interlinecustomroofingllc.com\u003e; rel=preconnect; crossorigin, \u003chttps://interlinecustomroofingllc.com\u003e; rel=dns-prefetch, \u003chttps://static.nresystems.com\u003e; rel=preconnect; crossorigin, \u003chttps://static.nresystems.com\u003e; rel=dns-prefetch\r\nVary: Accept-Encoding, Origin\r\nHost: tagivi.com\r\nexpires: Wed, 22 Jul 2026 23:28:01 GMT\r\nCache-Control: public, max-age=14400\r\nX-Request-ID: 807bf9a73f3c17325f2d08c9fd5fdcc1\r\nPragma: no-cache\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,X-Forwarded-For,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests,C-High-Entropy-Values\r\nAccess-Control-Expose-Headers: Content-Length,Content-Range\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Max-Age: 1728000\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\ncf-cache-status: BYPASS\r\nCF-RAY: a1f4d89b6a9fb1b8-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":75878,"size_decoded":31771,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"9504693c306f0f3ab62774b1251e59a9","sha1":"ad07dc49feaf6226ed688998cae15d311cecc6ed","sha256":"00152a75b04205b189e9c064f1c61c6ac4852761e4e17e23bad697bad4662a65","sha512":"67607237fa07327bfc53a30bbaeb958685889eaf06c7861f671d62efb4805da38f0c75f4690e6551253f07d628bdbb78d785cf50b923cbf60dcd8f9d0e82997a","ssdeep":"1536:zE5bPKHLvSIcWfOnh+i7SeeSJWbRlIHTghP8o:zg+RxhW2RDR","tlshash":"5473c5846f71a29706a4707f322daa42f1281d0a648cf078fe3b74e7a45d759f63e271","first_seen":"2026-07-22T19:28:44.641646Z","last_seen":"2026-07-22T19:28:44.641646Z","times_seen":1,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":4,"connect":1,"send":0,"wait":49,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"furiousexpansion.com/ren.gif?sid=H4sIAAAAAAAC_1xSPYwbRRSedSwKKBA_ikS3SBQgYd_O2uv1JgVSxE8B3CESFAmq-TUTr3c2O7u2YylSjiAkuisoKNef73JpiKCmAR8dVbZAuiLXUFMhIUrki6WLmOK9N-8bjb7vve-bZXVGuqjY6Scf24VJU7YTdQP_zZsmk3bm_N0bPg26wVX_pskG_av-fBOK6RXa63eDt_wPlBjbnTCgQUAD6r9vCqXtfOcchckf0STqDvpdSoddGoWYF__vuMqDYx7k9Iy8DCObF__UX8CINbLJj-8qNy5t_vZ7kyplpS0wlcefZePMzjJMLkpdeNDZ8fY1rGsI-b4Fmx1vVcBODzcqwE1DWpefgGfHW6rg06OnbHkKlYHLFzCbrqHSNQxbQ9j7MPIxAYTE7h6yyYNdW8zYnaco26ANaf_zN8ysIe0nryKbPLqWmrl_3aZVaWzmMNc1zHwNM1ojr05QLlowsxOI8isYSZBNlh0YefpGQBM95H3RSaRinThKok7Si3VHiUFIaRwnkdDnszF6DeYuoXIeKuOh0i1UeQsTeeqzZKh5MuizROlYy4DGgkW9XhL3o1APRIRK7MPIA4jiHvJi_6HsxarHRX_JMDYHcNKDKwmmsj6SqQtd_UCmruJ0m8Nt7tUrW46W7MiWI5URsOIAhawPTX7b3YcoL60W2smV3QTGy3rFuKxXRpYExe1ntLJgkHRiOdAdFkZRhw6CQayHXMlQHGpXVvUyPyMvbcbsHf9lMFanfhgnoRA9GVKmtUyGWjHGA6Eoi2PKYw5nahjXAnMeFqYhH46-RW4a4t1tgbMTuPQEwnhgFQWb1WBf1lhkP3Bj3djmIe1ufCRtjbxso7zjLdMz8srq0xvXfjlft_p1ASV-J9sDUdTIixq3zG8Eo3T_p728NBOzYJv9Xy9ZqZ4DM4_3_oUwDbn8PDk34pXX70Lk9-Dyi5-cJeD5JaSGIFUXfcZruGfu_KJeuq8xKtrgaXvF06J9yNMi_a4hH5k_GvL5w3fO6TZEnf0MZ079QPYVFQmLYq2iKOJRPxRa8yAOda8XDhOUrrnFXlv_FwAA__9qI8cwGQQAAA==","fqdn":"furiousexpansion.com","domain":"furiousexpansion.com","tld":"com"},"ip":{"addr":"172.240.127.244","port":443,"asn":7979,"as":"SERVERS-COM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.811Z","timestamp":1784748482811,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"furiousexpansion.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 21:40:07 GMT","end":"Wed, 23 Sep 2026 21:40:06 GMT"},"fingerprint":{"sha1":"81:6B:A0:BD:75:1F:EB:D5:DD:2D:06:86:4C:AC:44:33:8B:11:5A:CF","sha256":"D9:B3:84:86:0A:17:E7:7F:7A:93:D3:8F:17:B0:68:8F:10:08:3D:85:77:CF:94:4F:10:18:83:B2:FE:C5:1D:80"}}},"request":{"raw":"GET /ren.gif?sid=H4sIAAAAAAAC_1xSPYwbRRSedSwKKBA_ikS3SBQgYd_O2uv1JgVSxE8B3CESFAmq-TUTr3c2O7u2YylSjiAkuisoKNef73JpiKCmAR8dVbZAuiLXUFMhIUrki6WLmOK9N-8bjb7vve-bZXVGuqjY6Scf24VJU7YTdQP_zZsmk3bm_N0bPg26wVX_pskG_av-fBOK6RXa63eDt_wPlBjbnTCgQUAD6r9vCqXtfOcchckf0STqDvpdSoddGoWYF__vuMqDYx7k9Iy8DCObF__UX8CINbLJj-8qNy5t_vZ7kyplpS0wlcefZePMzjJMLkpdeNDZ8fY1rGsI-b4Fmx1vVcBODzcqwE1DWpefgGfHW6rg06OnbHkKlYHLFzCbrqHSNQxbQ9j7MPIxAYTE7h6yyYNdW8zYnaco26ANaf_zN8ysIe0nryKbPLqWmrl_3aZVaWzmMNc1zHwNM1ojr05QLlowsxOI8isYSZBNlh0YefpGQBM95H3RSaRinThKok7Si3VHiUFIaRwnkdDnszF6DeYuoXIeKuOh0i1UeQsTeeqzZKh5MuizROlYy4DGgkW9XhL3o1APRIRK7MPIA4jiHvJi_6HsxarHRX_JMDYHcNKDKwmmsj6SqQtd_UCmruJ0m8Nt7tUrW46W7MiWI5URsOIAhawPTX7b3YcoL60W2smV3QTGy3rFuKxXRpYExe1ntLJgkHRiOdAdFkZRhw6CQayHXMlQHGpXVvUyPyMvbcbsHf9lMFanfhgnoRA9GVKmtUyGWjHGA6Eoi2PKYw5nahjXAnMeFqYhH46-RW4a4t1tgbMTuPQEwnhgFQWb1WBf1lhkP3Bj3djmIe1ufCRtjbxso7zjLdMz8srq0xvXfjlft_p1ASV-J9sDUdTIixq3zG8Eo3T_p728NBOzYJv9Xy9ZqZ4DM4_3_oUwDbn8PDk34pXX70Lk9-Dyi5-cJeD5JaSGIFUXfcZruGfu_KJeuq8xKtrgaXvF06J9yNMi_a4hH5k_GvL5w3fO6TZEnf0MZ079QPYVFQmLYq2iKOJRPxRa8yAOda8XDhOUrrnFXlv_FwAA__9qI8cwGQQAAA== HTTP/1.1\r\nHost: furiousexpansion.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nCookie: uid_id2=019f8b4c-9dea-7595-937f-ec62117795cf:3:1; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; u_pl27782505=1; nlec2792cc3d21affd98feaab0ce1a771b7b=[5941311]\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Wed, 22 Jul 2026 19:28:03 GMT\r\nContent-Type: image/gif\r\nContent-Length: 7\r\nConnection: keep-alive\r\naccept-ch: Sec-Ch-Ua-Model,Sec-Ch-Ua-Mobile,X-Ucbrowser-Device-Ua,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version-List,Sec-Ch-Ua-Full-Version,Sec-Ch-Ua-Platform,Device-Stock-Ua,X-Device-User-Agent,X-Operamini-Phone-Ua,User-Agent,Sec-Ch-Ua\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\nvary: Origin,Accept-Encoding\r\nx-envoy-upstream-service-time: 3\r\nHost: furiousexpansion.com\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nX-Request-ID: 4f1fc1fe324ac1a668cf7dfa6d1dd521\r\nCache-Control: no-cache, max-age=0, private, no-cache\r\nPragma: no-cache\r\nStrict-Transport-Security: max-age=0; includeSubdomains\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/gif","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"furiousexpansion.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn2.tapioni.com/adgpt.js","fqdn":"cdn2.tapioni.com","domain":"tapioni.com","tld":"com"},"ip":{"addr":"172.66.163.179","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:02.290Z","timestamp":1784748482290,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdn2.tapioni.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 10 Jun 2026 06:06:43 GMT","end":"Tue, 08 Sep 2026 07:06:40 GMT"},"fingerprint":{"sha1":"30:52:01:54:6B:F2:4D:8C:98:90:D0:58:B2:EE:2B:CC:C9:41:70:F3","sha256":"6B:EB:BA:8E:C5:CB:11:AC:5F:FC:03:FB:5F:B5:E5:5C:31:8C:40:96:0F:08:D5:31:77:CD:10:25:EA:36:30:5B"}}},"request":{"raw":"GET /adgpt.js HTTP/1.1\r\nHost: cdn2.tapioni.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 22 Jul 2026 19:28:02 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 862\r\nserver: cloudflare\r\nlast-modified: Fri, 03 Jul 2026 08:04:39 GMT\r\nvary: Accept-Encoding\r\netag: \"6a476d17-35e\"\r\ncontent-encoding: gzip\r\nexpires: Thu, 23 Jul 2026 08:14:37 GMT\r\ncache-control: public, max-age=86400\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15768000\r\nage: 40404\r\ncf-cache-status: HIT\r\ncf-ray: a1f4d89e687135a6-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1837,"size_decoded":1337,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (1837), with no line terminators","md5":"971529bb571548f4c89e1e978a978cdf","sha1":"6ca24a87f4969c1a75d76214d9cb9eccfecf8b62","sha256":"a07cbaa80986b90f9222673affec7fa83c9f63f92b950fe113a6d7c89cb4c41c","sha512":"5985cbaeef1e1afc4500a87c365d7125bf9867239d7b1452d3e502e96a900eb207ab2754911b7057558fa3ce5713d7374be0d3e25a92869ce1daa30bf5df34fa","ssdeep":"","tlshash":"543110db31a1edb1078b6048602f1809f5fcb4a0a3ade8d1dfa5c9747d381484062eee","first_seen":"2026-07-03T08:30:14.105136Z","last_seen":"2026-07-22T20:42:18.902838Z","times_seen":141,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":6,"connect":4,"send":0,"wait":5,"receive":0,"ssl":11},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"cdn2.tapioni.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipsadminuser.shop/api/ip-sync/sync","fqdn":"ipsadminuser.shop","domain":"ipsadminuser.shop","tld":"shop"},"ip":{"addr":"172.67.205.92","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cursor.railway.cam/qqtime/qqtime.html","date":"2026-07-22T19:28:07.303Z","timestamp":1784748487303,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipsadminuser.shop","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 23 Jun 2026 18:20:42 GMT","end":"Mon, 21 Sep 2026 18:20:41 GMT"},"fingerprint":{"sha1":"9B:DF:EE:39:98:FB:B8:1F:A6:1E:E4:B8:13:3D:90:3B:F1:FB:0C:4C","sha256":"94:57:B8:50:98:AB:A7:AE:B7:29:CD:4D:D6:4C:E5:6F:7B:1A:5B:63:FC:33:A8:29:55:0A:29:30:C5:0E:07:5C"}}},"request":{"raw":"OPTIONS /api/ip-sync/sync HTTP/1.1\r\nHost: ipsadminuser.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://cursor.railway.cam/\r\nOrigin: https://cursor.railway.cam\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 22 Jul 2026 19:28:07 GMT\r\nserver-timing: cfExtPri\r\nset-cookie: bt_route=3d2205ef087b8aa44ccb9272f5894457; Expires=Thu, 23-Jul-2026 07:28:07 GMT; Path=/; HttpOnly\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://cursor.railway.cam\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: content-type\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=G8M4RudPZPiEnkCovujL83dkFe4vfkej8j6IlNyBbuCOU4ZNUQFQOnRgRfgal5lnUwwSz0L12COdvqpvTpwbJ34N%2B6Lsn3b0MYbaz%2F69ffMSK7J1ldL516Oz6R6hbKsJP2bWLw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: a1f4d8bdbfb256c6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":1033,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":620,"timings":{"blocked":-1,"dns":1,"connect":18,"send":0,"wait":601,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"backupdata.b-cdn.net/duitsbalisk.png","fqdn":"backupdata.b-cdn.net","domain":"b-cdn.net","tld":"net"},"ip":{"addr":"138.199.46.65","port":80,"asn":60068,"as":"Datacamp Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://212.212.104.25/","date":"2026-07-22T19:28:01.875Z","timestamp":1784748481875,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /duitsbalisk.png HTTP/1.1\r\nHost: backupdata.b-cdn.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://212.212.104.25/\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nDate: Wed, 22 Jul 2026 19:28:02 GMT\r\nContent-Type: text/html\r\nContent-Length: 166\r\nConnection: keep-alive\r\nServer: BunnyCDN-SG1-1274\r\nCDN-PullZone: 456355\r\nCDN-RequestCountryCode: NO\r\nLocation: https://backupdata.b-cdn.net/duitsbalisk.png\r\nCDN-RequestId: 93a279a3eb8cbad254f47860f3b10d97\r\nCDN-RequestTime: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T21:24:26.350516Z","times_seen":17460679,"resource_available":true,"data":null}},"time_used":428,"timings":{"blocked":-1,"dns":24,"connect":202,"send":0,"wait":202,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}