{"report_id":"2167d2c6-7d06-4492-becb-4b5de25c83e9","version":6,"status":"done","tags":[],"date":"2026-03-26T22:40:39Z","url":{"schema":"https","addr":"crimsonmods.com/","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"ip":{"addr":"80.66.84.114","port":0,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"crimsonmods.com/","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"title":"Crimsonmods — Download Premium Game Mods","dom":{"size":22231,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"5417867165e66d3981ec6ef8ea043148","sha1":"773902ab1bbd192210a257142f1b3a52502cfb1a","sha256":"46540bee490eb3676b4a9253170f409bedb72c6198d0c30f9a275cc680d10852","sha512":"e43462e8abff3740b25954b67e7b1136db9643220ae262f96b39370660df4eb9b93e3c949160d920f60234c9fc9e53f0594102613c60e9cb9f69ec8b222399f5","ssdeep":"192:mNkSyu9rOwPiP5uuJytcWVP6qMg4ralw3FH7b/ytxzyTIzy1+v4VxhTA4YCrj:mNkFu9iwPiP5uueFULV1C58xW4j","tlshash":"41a2312665f2607300e392d16aa5772b7f92e917da1b9a0072fc0bcc5fd7d96cc4311a","dom_hash":"domhash0a4ddb09e13cd7d461635149076e6c46","first_seen":"2026-03-26T22:40:47.682556Z","last_seen":"2026-03-26T22:40:47.682556Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"crimsonmods.com/","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"ip":{"addr":"80.66.84.114","port":0,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-30T22:40:39Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-03-22T22:16:16.728956Z","alert_count":0,"request_count":5,"received_data":44283,"sent_data":2689,"comment":"","tags":null,"fingerprints":null},{"fqdn":"crimsonmods.com","ip":{"addr":"80.66.84.114","port":443,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":45,"request_count":9,"received_data":9889415,"sent_data":4063,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-03-22T22:31:48.48691Z","alert_count":0,"request_count":2,"received_data":254166,"sent_data":1019,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-03-22T22:20:05.651051Z","alert_count":0,"request_count":2,"received_data":32932,"sent_data":1103,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"i.imgur.com","ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2009-01-09","domain_rank":3309,"first_seen":"2012-05-21T08:09:36Z","last_seen":"2026-03-25T22:38:31.758142Z","alert_count":0,"request_count":5,"received_data":3539529,"sent_data":2160,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"crimsonmods.com/js/join-to-panel.js","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"ip":{"addr":"80.66.84.114","port":443,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"e34de8eb2888a86add62f4afa8f8cf71","sha1":"a100f9c444c0df26174b79eea42ea3ad4638e18e","sha256":"e2308d6f1a7369d8ac81d531549e1d763508ad3f595d4a8d48811ff6cf9ff5e6","sha512":"fa2ad443b014c5fd64e8d834fab4f7c8d4a70bbee8732c5a67f1b484f7f1df2d0b5a53da7039976db10003de438cfb84c681d926aac6bee7b41dc5766c0dfddb","ssdeep":"","tlshash":"f9d02220d8182de2803eb3bcaf26e890b9371de2d00461013e1c4e1caf3002f877af54","size":214,"data":"","first_seen":"2025-06-16T19:42:38.975387Z","last_seen":"2026-07-20T13:44:28.696303Z","times_seen":61,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crimsonmods.com/js/script.js","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"ip":{"addr":"80.66.84.114","port":443,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"2a2ca53dcf5084673968554d5c4f632a","sha1":"cdf7bdbba1447ae7ff1df30931fedcf12df26242","sha256":"54a78eecccc8be7af9601ec49c5d09fb491ad32c34a90e36661da76095d11a19","sha512":"3f7083b0c92700530eb9e6fbf8c9c661598e580d3da778ce6c26eaba85cd0ea463479b323b67c92cff7d8ded8ec9ac9984ad4ac532b5c04554134b95517b5437","ssdeep":"192:j2Ug0IkOuLrwrH300eoegPP09DiD30JPDiDlM50VtjZY:pvik0LZctiDEJbiDlM50V7Y","tlshash":"91f1016a06792132417b63b7ac87174dfb3061ab712168893d2cc5c90fb2d5295a3ffa","size":7777,"data":"","first_seen":"2025-06-16T19:42:38.984078Z","last_seen":"2026-07-20T13:44:28.691516Z","times_seen":61,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crimsonmods.com/","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"ip":{"addr":"80.66.84.114","port":443,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"fb29d53d79800944f29e4a9af54c26b7","sha1":"6dd2d3d90ca489ad12c919dc80d3c510563aba6f","sha256":"89ac23d77f5a7a0dbecd2d227c82fefcf4ae6442bb172f453adb1dfc2aad769c","sha512":"9e91418e97e6365917f1f9febb63023d98ab0889c71817ce1ee9e24a9260302111d2e694c08c282f9ce3dd7842ee64d95235db2420744e03e964e2c39f115e7d","ssdeep":"","tlshash":"4eb0125337791430c5bbb49a43d753ace03362033a81d23a7e1f83048d44782d0f90c4","size":121,"data":"","first_seen":"2025-06-16T19:42:38.99778Z","last_seen":"2026-06-01T05:43:19.05478Z","times_seen":48,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"i.imgur.com/b7VESE5.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:17.857Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 13 Feb 2026 00:00:00 GMT","end":"Mon, 15 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D4:9A:34:EF:13:3D:45:98:6B:98:4B:9D:CD:FC:74:9C:06:42:A0:7A","sha256":"90:50:0F:E4:90:40:B5:50:04:7E:E1:6E:55:14:FE:7B:38:BB:79:2B:70:83:78:AC:16:E0:F7:1E:3D:ED:92:9A"}}},"request":{"raw":"GET /b7VESE5.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Fri, 26 Dec 2025 09:57:51 GMT\r\netag: \"4e1443360f85da4999212eaddca5de8f\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: eMDUohlFDx3Ba0qT2Hy8eqpcYg974A2E5lvfevIc4hLB6FVNc_hCLw==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nage: 18468\r\ndate: Thu, 26 Mar 2026 22:40:18 GMT\r\nx-served-by: cache-iad-kcgs7200124-IAD, cache-hel1410028-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 334, 0\r\nx-timer: S1774564818.910579,VS0,VE102\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 792926\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":792926,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 720, 8-bit/color RGB, non-interlaced","md5":"4e1443360f85da4999212eaddca5de8f","sha1":"2e7451949d5197790837ef8cf4068341936577b5","sha256":"21424ac52de496e7efd5444191140e98d17278cc69d52c512c198c03a3244ae0","sha512":"33f8f65d9b7bf5e63886950490d8f049e9998fc64352892357ffad02af6119b7d1be9723520422d52ece1134a4382c3b7a5891ec1bee88a26dc47a840ddfc60e","ssdeep":"12288:rxog6siqyGUxIz8fT9fzqWvUV62so+FkGNrBMnQOkucPJapZUJ1ALP1n4ke/:adsiqGBfGWq3WhZOKPYpZE1ALP1n4ke/","tlshash":"37f4338fd49c5d430cc659ea49c5448fe51f6f23077315adb868aac037a1b139aef8c6","first_seen":"2026-01-11T14:19:38.514231Z","last_seen":"2026-03-26T22:40:47.685341Z","times_seen":3,"resource_available":false,"data":null}},"time_used":245,"timings":{"blocked":45,"dns":0,"connect":0,"send":0,"wait":127,"receive":73,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/poppins/v24/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:18.141Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/poppins/v24/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://crimsonmods.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 7816\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 26 Mar 2026 12:40:29 GMT\r\nexpires: Fri, 26 Mar 2027 12:40:29 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 16:35:07 GMT\r\ncontent-type: font/woff2\r\nage: 35989\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":7816,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 7816, version 1.0","md5":"25b0e113ca7cce3770d542736db26368","sha1":"cb726212d5d525021752a1d8470a0fb593e0c49e","sha256":"9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526","sha512":"a0d331e62ab4727f49ca286a1ee7fb81cddc5bb9edf71ef84f4bd4fa1552069af1a82752011ba88fae80862d034135926b7e99d70e59d626d66d4ede90e94c30","ssdeep":"192:Agw5ksLwlyK8F2BXU96Fc575OI3+ga534SlEFwTG4ovej9be:Al5y8FSUMS5VOq1KISlvS4ov+4","tlshash":"a3f1af19d5de5a73f80032b45b6911ba7e42fa83bc68bbedf8046a10ad542cb467cc91","first_seen":"2023-04-05T13:48:05Z","last_seen":"2026-08-05T19:03:38.739593Z","times_seen":293086,"resource_available":true,"data":null}},"time_used":385,"timings":{"blocked":185,"dns":7,"connect":21,"send":0,"wait":8,"receive":1,"ssl":147},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/poppins/v24/pxiGyp8kv8JHgFVrJJLucHtA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:18.152Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/poppins/v24/pxiGyp8kv8JHgFVrJJLucHtA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://crimsonmods.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 8668\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 22 Mar 2026 02:01:42 GMT\r\nexpires: Mon, 22 Mar 2027 02:01:42 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 16:34:16 GMT\r\ncontent-type: font/woff2\r\nage: 419916\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":8668,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 8668, version 1.0","md5":"a242ba0df3a128a2cab929a8c45d5056","sha1":"d70e2c70b21cbb66cd883ae56e2dedacefd81c7c","sha256":"50d0c1742d80ac71f4cde20e8c04d41a24806af342831f479938b527fbff0972","sha512":"fc85567dd0270a60d684f9e7fe8788006b2a4985a683334294c5b2b8e1dd9d268a787c232c91087fa25d8fbf81c73894c3846e3d4deb97a1722575cc9c93b541","ssdeep":"192:mnQ9l6zvmoW1McErCT/IHf11y41NSUVZVdH9aTbMlcE:mQ9l6CoW4+rIH7y41QUVZXcT9E","tlshash":"e102af8a951b1eced41769b184abc61fd78894199bf2708fe05d34c15dfbcacc707421","first_seen":"2023-04-05T18:53:14Z","last_seen":"2026-08-05T18:15:33.544987Z","times_seen":30633,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":168,"dns":0,"connect":0,"send":0,"wait":12,"receive":1,"ssl":154},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crimsonmods.com/","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"ip":{"addr":"80.66.84.114","port":443,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-26T22:40:17.448Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crimsonmods.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Mar 2026 02:48:54 GMT","end":"Wed, 17 Jun 2026 02:48:53 GMT"},"fingerprint":{"sha1":"FB:92:B1:B7:C1:EE:41:2A:70:B2:23:45:C9:9B:C0:B6:AD:91:FC:80","sha256":"3C:42:B3:D8:87:21:D9:6F:A7:A0:B9:4D:52:0A:AA:D4:6F:19:EC:8C:03:20:8F:9B:3C:05:7F:27:57:26:B9:84"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: crimsonmods.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Thu, 26 Mar 2026 22:40:17 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 4611\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22150,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"6a31129fd573a3d37b8eede0e4c12304","sha1":"91fb6f9fe21bbf64a86563600f5c443373192b11","sha256":"3fcfdf913eb9cf26ee8922a8e04ce2b2e6533f4c9847048ff5cd977302775086","sha512":"02386ba71323d4d4b8a00a05323455c6408ddaab1aad5124bf499cb879785d3e39dc145982c119f9f353d44dcbf04993ed29fbd0343938ee36bd335ba24013bf","ssdeep":"192:akkBB9ELThQ55Usf+WrU8fEt7hxV7YC1tFv1ILb1n5I9SQry5Dd/:akkBB9wThQ55rJU60NxNqGSQyn/","tlshash":"65a2d83a65d2602310b392d99a25bbaafe91c147db0baa0032fc17cb5ff7d15dc53152","first_seen":"2026-03-26T22:40:47.688346Z","last_seen":"2026-03-26T22:40:47.688346Z","times_seen":1,"resource_available":false,"data":null}},"time_used":352,"timings":{"blocked":117,"dns":69,"connect":19,"send":0,"wait":115,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:17.846Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Mar 2026 00:38:49 GMT","end":"Fri, 12 Jun 2026 01:38:45 GMT"},"fingerprint":{"sha1":"7A:4A:F6:D6:63:62:70:CA:51:C5:5A:06:41:17:71:BF:9D:2C:C9:42","sha256":"7F:F5:F5:FE:73:1F:E7:AF:1A:82:5B:59:EE:E8:E9:65:D6:87:68:61:8C:11:1E:94:4A:9A:C4:14:BD:4B:04:BA"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.4.0/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 26 Mar 2026 22:40:17 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 18752\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"6421d693-4940\"\r\nlast-modified: Mon, 27 Mar 2023 17:46:59 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 137682\r\nexpires: Tue, 16 Mar 2027 22:40:17 GMT\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RSF3jeOaDqm0XlwhwYq4W7vOfFpPySBqzE9a1T9%2B0zXHdZzAHcga5%2FN5bxiLXZWf8WGdfEL1xOGi26n0LUTZp6YHsFBVUGmmg2MHkDp9uCm7Npa9xPfvR81cxlca7skhwAt9ZlfN\"}]}\r\ncf-ray: 9e29a7ff9a53568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":102025,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (52276)","md5":"ded1c367363e8b20bdc6a19b8350a737","sha1":"8c06d82739d14b094ff6d9036021a252bd1d985d","sha256":"1edb1725a9ea8ca4dcf2f5508cee183218aa1685e47c1b23056717f754f58ebf","sha512":"89e71d2e66ac925ec2564aa45cd43f647fd72e5bd664e2728fb632eed71e9e6a43d72a404a8ce9993fc4d223ed985201e3a66676d01cf5e341bc7d07fd9a6207","ssdeep":"1536:OwMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPGuZprfZCl:S709gMGFiyPGuZpfZCl","tlshash":"2ea3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2023-04-06T15:05:25Z","last_seen":"2026-08-05T19:05:45.181504Z","times_seen":59144,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":3,"dns":0,"connect":1,"send":0,"wait":8,"receive":1,"ssl":11},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/TrOQTML.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:17.854Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 13 Feb 2026 00:00:00 GMT","end":"Mon, 15 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D4:9A:34:EF:13:3D:45:98:6B:98:4B:9D:CD:FC:74:9C:06:42:A0:7A","sha256":"90:50:0F:E4:90:40:B5:50:04:7E:E1:6E:55:14:FE:7B:38:BB:79:2B:70:83:78:AC:16:E0:F7:1E:3D:ED:92:9A"}}},"request":{"raw":"GET /TrOQTML.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Thu, 18 Dec 2025 18:53:04 GMT\r\netag: \"aca5d94a76e4b62e2daf7757256a1985\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: -IbfInA52WKXRKtD7qnhpnRlQQZgxYvVdulpYSZGyW7H0780_wFcHg==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nage: 212729\r\ndate: Thu, 26 Mar 2026 22:40:17 GMT\r\nx-served-by: cache-iad-kcgs7200093-IAD, cache-hel1410028-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 16, 0\r\nx-timer: S1774564818.910263,VS0,VE1\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 667965\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":667965,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 720, 8-bit/color RGB, non-interlaced","md5":"aca5d94a76e4b62e2daf7757256a1985","sha1":"e460e8002bd77567df7c0a81e6b2dc53326b4dce","sha256":"b560d1d0bf2a10705e5309eb21705d4422eb16e12c0f18c0051baf2210dccd37","sha512":"a378a188b61c059adbab69a0d9a567fe4539a809805bd90cca3e879af2435fc56689d2c27430fe22502b9dcba13ee04c521a483660cab51fdfb246a2986c75d3","ssdeep":"12288:zhELGBhlkiEy5msY2b71wIgrMfYD4dHm3KP1KIuzyMIEdgxvCayZ:tP7kiEy5mM76IYMw6CKP1Ku7iXayZ","tlshash":"abe423a620526e608c0eb81553a3ffe8155e5d02cb3fa0c9865eff0ef7699c185d1f0a","first_seen":"2026-01-11T14:19:38.526121Z","last_seen":"2026-04-15T00:29:26.2276Z","times_seen":9,"resource_available":false,"data":null}},"time_used":211,"timings":{"blocked":48,"dns":11,"connect":15,"send":0,"wait":14,"receive":86,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/5eTTFPH.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:17.856Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 13 Feb 2026 00:00:00 GMT","end":"Mon, 15 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D4:9A:34:EF:13:3D:45:98:6B:98:4B:9D:CD:FC:74:9C:06:42:A0:7A","sha256":"90:50:0F:E4:90:40:B5:50:04:7E:E1:6E:55:14:FE:7B:38:BB:79:2B:70:83:78:AC:16:E0:F7:1E:3D:ED:92:9A"}}},"request":{"raw":"GET /5eTTFPH.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Thu, 18 Dec 2025 11:39:30 GMT\r\netag: \"4044663ebc6b4f4f374feb96bce9922c\"\r\nx-amz-storage-class: STANDARD_IA\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: 36CNIYI0NV7zXHqnMruAvugV55QxgzoceOSGmCkEi5JFK0j1RhCDQw==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\ndate: Thu, 26 Mar 2026 22:40:17 GMT\r\nage: 41324\r\nx-served-by: cache-iad-kiad7000138-IAD, cache-hel1410028-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 2, 2\r\nx-timer: S1774564818.910395,VS0,VE1\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 657485\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":657485,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 720, 8-bit/color RGB, non-interlaced","md5":"4044663ebc6b4f4f374feb96bce9922c","sha1":"96eee1a862a1350ab6a6cff5cf26fb03d912735c","sha256":"a6dca2221532a96fd5daad4aaa88a80f97daa20866a8896097a9dea42d60cfab","sha512":"4153e2bee96105145c41247ee7bcde47bb1ef5fbce0e67af7bd841ee866929524be46e94c09fbad420a88ace279f78200213216c715ba92ea29d35dd249ff5c1","ssdeep":"12288:4OuJTP5zu4fRAjWdt6M0lcquyt9/4fqisAAsCECeRnJb2D8KXr2UPmmBl3:NuxP5l5Amt04k7AQENob72Mmq1","tlshash":"abe43356e3da2fbcab9c8215a7172fa127b1d671bae0deb8d04570adf3314005dc9c1a","first_seen":"2026-01-11T14:19:38.543136Z","last_seen":"2026-04-15T00:29:26.232752Z","times_seen":9,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":46,"dns":0,"connect":0,"send":0,"wait":29,"receive":83,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crimsonmods.com/video/mods-showcase.mp4","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"ip":{"addr":"80.66.84.114","port":443,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:17.910Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crimsonmods.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Mar 2026 02:48:54 GMT","end":"Wed, 17 Jun 2026 02:48:53 GMT"},"fingerprint":{"sha1":"FB:92:B1:B7:C1:EE:41:2A:70:B2:23:45:C9:9B:C0:B6:AD:91:FC:80","sha256":"3C:42:B3:D8:87:21:D9:6F:A7:A0:B9:4D:52:0A:AA:D4:6F:19:EC:8C:03:20:8F:9B:3C:05:7F:27:57:26:B9:84"}}},"request":{"raw":"GET /video/mods-showcase.mp4 HTTP/1.1\r\nHost: crimsonmods.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nServer: nginx/1.28.2\r\nDate: Thu, 26 Mar 2026 22:40:18 GMT\r\nContent-Type: video/mp4\r\nContent-Length: 8753792\r\nConnection: keep-alive\r\nLast-Modified: Sat, 08 Nov 2025 11:41:29 GMT\r\nETag: \"859280-64313c7652c40\"\r\nAccept-Ranges: bytes\r\nContent-Range: bytes 0-8753791/8753792\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8753792,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"27ace12dce547f6fbd02d83d93244201","sha1":"9eaea1710ff27841c4b869e72a413f49d5064801","sha256":"10f6a3a254e8c3db42ac4b0c87692198bd5a3c36ce791d29766ee9a7ab3ef7ed","sha512":"485c9d82666718c36380f33709285900574d35d1f6a59f1f1e2fa96683947c52b102248293f84e324d5d0fc23c9cfc246b732d6597126f73103e3044ea97cfd5","ssdeep":"12288:o6xNMtoISMRlU/RXPXboWf7R89cJJOke2ZEQV1x+I67jZzPZ/bTma4r1gM28Y9jd:ZNS5IRMuFJOTi/Hx+IevuaOPY9x","tlshash":"342523107770529bc8ea1afe3af3e380bfa4d5a2430b4907572573ad7ced614a25a5c3","first_seen":"2026-01-11T14:19:38.536691Z","last_seen":"2026-03-26T22:40:47.707826Z","times_seen":2,"resource_available":false,"data":null}},"time_used":856,"timings":{"blocked":125,"dns":0,"connect":0,"send":0,"wait":119,"receive":612,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100..900;1,100..900\u0026family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:17.916Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"63:D1:AE:99:1E:49:D7:6C:71:F3:BA:F5:BA:47:74:1E:EB:90:E7:D6","sha256":"69:90:BB:9D:82:60:82:88:FF:CE:F6:B3:3D:DD:B5:B5:FB:F0:56:17:FD:FA:0D:BC:9C:5B:83:51:98:0D:2F:CF"}}},"request":{"raw":"GET /css2?family=Montserrat:ital,wght@0,100..900;1,100..900\u0026family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Thu, 26 Mar 2026 22:40:18 GMT\r\ndate: Thu, 26 Mar 2026 22:40:18 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25567,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"b6fcb5c566aeec511a8296d50d1b0f2a","sha1":"6f6068938c5832e0dd7a5c93409c2bb269644eb4","sha256":"faf8773f9121cc3021aa984bd7a446197e9a9109deff7d62e2eff9da003aaf4b","sha512":"ff50ecef41e18d897b1437309fe58b55e5e205e9e8a7a14311db00a4cb0437737e6bfa619d40e16d3d3a7c6586a73b09ea577eab4cfd4bfd814515156ee70a9d","ssdeep":"384:AhwCFnbL8V3w3s3VR9xqWSUq+DnLami0A0BNBOi/mkX:zEA3mkX","tlshash":"e7b29a91087be114ab871cc123cf7d36ee0ea255b850d5786bfd1cd8adabc660361b2d","first_seen":"2025-09-17T10:32:05.770794Z","last_seen":"2026-07-30T19:09:39.932451Z","times_seen":311,"resource_available":false,"data":null}},"time_used":176,"timings":{"blocked":62,"dns":1,"connect":20,"send":0,"wait":51,"receive":0,"ssl":39},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/webfonts/fa-solid-900.woff2","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:18.139Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Mar 2026 00:38:49 GMT","end":"Fri, 12 Jun 2026 01:38:45 GMT"},"fingerprint":{"sha1":"7A:4A:F6:D6:63:62:70:CA:51:C5:5A:06:41:17:71:BF:9D:2C:C9:42","sha256":"7F:F5:F5:FE:73:1F:E7:AF:1A:82:5B:59:EE:E8:E9:65:D6:87:68:61:8C:11:1E:94:4A:9A:C4:14:BD:4B:04:BA"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.4.0/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://crimsonmods.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cdnjs.cloudflare.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 26 Mar 2026 22:40:18 GMT\r\ncontent-type: application/octet-stream; charset=utf-8\r\ncontent-length: 150124\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\netag: \"6421d693-24a6c\"\r\nlast-modified: Mon, 27 Mar 2023 17:46:59 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 840311\r\nexpires: Tue, 16 Mar 2027 22:40:18 GMT\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jxd8n8wSHxQgJWclm6YTlGK%2BA6qoJ4tIypenMSNI7vh5NE%2BbNP8aQXHTESMq7VMIWrY5H0myzzd%2B8nnNHxrlWA6ivvEjHdN5dqh7cRpOgtq8vz6nHnbmF1qj2V4s87LkMoZZOcci\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\ncf-ray: 9e29a8017f821a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":150124,"size_decoded":0,"mime_type":"application/octet-stream; charset=utf-8","magic":"Web Open Font Format (Version 2), TrueType, length 150124, version 772.256","md5":"c64278386c2bbb5e293e11b94ca2f6d1","sha1":"6b99aa650bd12a36caa14e0127435d8f4cd3ba73","sha256":"7152a6933ee3d690ec2af3d09da9d701723d16aa3410a6d80f28ff8866f3b880","sha512":"0ccdc1515510d902c0b4a48b863c48bad86e1f766b1f9c890a64e28d91ee7c6d488241c531fc094d15b29c211da71e092587a987e24ee8e67ef8ea99c284e821","ssdeep":"3072:7sCbk7w0ZXdkN6iMjif3Lr7x7wAtf+D7gDk1feXDLnurWHqrNIuv5n0:7sCbkFZXdC7MaLr9w2mIY1feXXurWyNW","tlshash":"28e3123cf2c6d486735f5aeadb79636894fd0a2e74ecc67d26b982112048f828174d1d","first_seen":"2023-04-09T20:30:06Z","last_seen":"2026-08-05T17:59:28.275997Z","times_seen":44697,"resource_available":false,"data":null}},"time_used":106,"timings":{"blocked":11,"dns":0,"connect":0,"send":0,"wait":10,"receive":85,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/poppins/v24/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:18.145Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/poppins/v24/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://crimsonmods.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 8000\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 22 Mar 2026 10:06:09 GMT\r\nexpires: Mon, 22 Mar 2027 10:06:09 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 16:33:57 GMT\r\ncontent-type: font/woff2\r\nage: 390849\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":8000,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 8000, version 1.0","md5":"72993dddf88a63e8f226656f7de88e57","sha1":"179f97ec0275f09603a8db94d4380eb584d81cd5","sha256":"f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149","sha512":"7c20165f9d22a86341e841fd58526209017dcde2afe2d0d2a89fe853d95dc69f658d25cf798c71f452dab09843fc808c1ae87a60b1284134163abf5a1d93e50a","ssdeep":"192:GDonmfrEdXT8WrxzRXwyQo3zGEOM7Y2hOMgWnsfYSjv4ENFGwrlKJ:8onPxTzjgyQSzLPXOTIYHJAJ","tlshash":"08f1b0ffa92456c4df692475a5044f27623652b4dd35cb2f496f3e12d2d74224bcc4c1","first_seen":"2023-04-05T18:53:14Z","last_seen":"2026-08-05T19:03:38.748028Z","times_seen":288227,"resource_available":false,"data":null}},"time_used":351,"timings":{"blocked":169,"dns":7,"connect":11,"send":0,"wait":9,"receive":5,"ssl":144},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crimsonmods.com/js/script.js","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"ip":{"addr":"80.66.84.114","port":443,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:17.862Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crimsonmods.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Mar 2026 02:48:54 GMT","end":"Wed, 17 Jun 2026 02:48:53 GMT"},"fingerprint":{"sha1":"FB:92:B1:B7:C1:EE:41:2A:70:B2:23:45:C9:9B:C0:B6:AD:91:FC:80","sha256":"3C:42:B3:D8:87:21:D9:6F:A7:A0:B9:4D:52:0A:AA:D4:6F:19:EC:8C:03:20:8F:9B:3C:05:7F:27:57:26:B9:84"}}},"request":{"raw":"GET /js/script.js HTTP/1.1\r\nHost: crimsonmods.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Thu, 26 Mar 2026 22:40:17 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Wed, 02 Jul 2025 20:53:41 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68659c55-1e61\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7777,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"2a2ca53dcf5084673968554d5c4f632a","sha1":"cdf7bdbba1447ae7ff1df30931fedcf12df26242","sha256":"54a78eecccc8be7af9601ec49c5d09fb491ad32c34a90e36661da76095d11a19","sha512":"3f7083b0c92700530eb9e6fbf8c9c661598e580d3da778ce6c26eaba85cd0ea463479b323b67c92cff7d8ded8ec9ac9984ad4ac532b5c04554134b95517b5437","ssdeep":"192:j2Ug0IkOuLrwrH300eoegPP09DiD30JPDiDlM50VtjZY:pvik0LZctiDEJbiDlM50V7Y","tlshash":"91f1016a06792132417b63b7ac87174dfb3061ab712168893d2cc5c90fb2d5295a3ffa","first_seen":"2025-06-16T19:42:38.984078Z","last_seen":"2026-07-20T13:44:28.691516Z","times_seen":61,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/poppins/v24/pxiEyp8kv8JHgFVrJJfecg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:18.137Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/poppins/v24/pxiEyp8kv8JHgFVrJJfecg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://crimsonmods.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 7884\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 25 Mar 2026 19:50:54 GMT\r\nexpires: Thu, 25 Mar 2027 19:50:54 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 16:34:42 GMT\r\ncontent-type: font/woff2\r\nage: 96564\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":7884,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 7884, version 1.0","md5":"9212f6f9860f9fc6c69b02fedf6db8c3","sha1":"ac6d71b4d5fdd2b3dabc9a06ff6c001e4251da0b","sha256":"7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f","sha512":"67317495f4b53e20a9f31c034e456e6c37f387dffb2c092caa5159bc441cfcadd02749ffe5bbed1d580d5300a59e48a767ef2c6d9978b474f84c1a2cd095c126","ssdeep":"192:xLFDbKO9E3rS3JWBRO/J601FSS5ZUbik3Zy2f0:pd9J5W501otlI","tlshash":"c3f1ae4eb3f2cd1be40982e53a0fc90b1c578272681fd772d067a22517893bc8db2c81","first_seen":"2023-04-05T15:35:34Z","last_seen":"2026-08-05T18:57:24.615447Z","times_seen":387871,"resource_available":false,"data":null}},"time_used":355,"timings":{"blocked":172,"dns":0,"connect":7,"send":0,"wait":10,"receive":1,"ssl":162},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crimsonmods.com/favicons/apple-touch-icon.png","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"ip":{"addr":"80.66.84.114","port":443,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:18.560Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crimsonmods.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Mar 2026 02:48:54 GMT","end":"Wed, 17 Jun 2026 02:48:53 GMT"},"fingerprint":{"sha1":"FB:92:B1:B7:C1:EE:41:2A:70:B2:23:45:C9:9B:C0:B6:AD:91:FC:80","sha256":"3C:42:B3:D8:87:21:D9:6F:A7:A0:B9:4D:52:0A:AA:D4:6F:19:EC:8C:03:20:8F:9B:3C:05:7F:27:57:26:B9:84"}}},"request":{"raw":"GET /favicons/apple-touch-icon.png HTTP/1.1\r\nHost: crimsonmods.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Thu, 26 Mar 2026 22:40:18 GMT\r\nContent-Type: image/png\r\nLast-Modified: Wed, 02 Jul 2025 20:53:34 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68659c4e-15ae\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5550,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"8dcfe02d95e887d8bf8daaf236caac41","sha1":"f98718f7ac6fa5745ec15edae6592f2f7199782f","sha256":"f575138ae4a57cca84ba92292dd117be34302920aad8275aa975f323fa89a0d1","sha512":"a367e2b171dd62b94b91a226818e6a885ab4cc6dbf6b5fe6b8dc5b41aa6ef3db6c24c6ae632d0ce29ab2a0aa29d9ec95f901610101abe4cb9b1e326e88ca0c45","ssdeep":"96:XsVVYdUmAShYAWCh190QWZ02j8d+xSfPcDevo/9+hCO7Z7Z7l:cVVYdJhYwh1SQQ02kzAV83","tlshash":"02b17ce755b5de3dee238f2d25949da864e16af5a337611b68f46d10303216c1c329f0","first_seen":"2025-06-16T19:42:38.992944Z","last_seen":"2026-06-21T03:56:14.801781Z","times_seen":51,"resource_available":false,"data":null}},"time_used":231,"timings":{"blocked":206,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Poppins:wght@300;400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:17.850Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"63:D1:AE:99:1E:49:D7:6C:71:F3:BA:F5:BA:47:74:1E:EB:90:E7:D6","sha256":"69:90:BB:9D:82:60:82:88:FF:CE:F6:B3:3D:DD:B5:B5:FB:F0:56:17:FD:FA:0D:BC:9C:5B:83:51:98:0D:2F:CF"}}},"request":{"raw":"GET /css2?family=Poppins:wght@300;400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Thu, 26 Mar 2026 22:40:17 GMT\r\ndate: Thu, 26 Mar 2026 22:40:17 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5993,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"9c51d4ed0528132b3a6be429dca636b5","sha1":"18cc681e66f5b6696a4ff89774e53aef2a51af00","sha256":"45a8505a86014b27b96db52f81bf4dbced7a8eb9b419d28e89bcfccb334b49b2","sha512":"3fa61799ef336da5f4c9a0a0fcf7d14fdb09e2e18cbc1488eae44a06b61beca3831c9eadd77b22a16a84e8041074d74d51429e23a1a6e8ce9b56860ed682e800","ssdeep":"96:SO1arO1aTJc+ukO1aaN3OEanOEaCJc+ukOEauN3OXa3OXavJc+ukOXaON3OxMac8:4hHdPgKQcXr3lVwa3RzJZ","tlshash":"15c19cd1087be114ab831cc123cf7d36ee1e9255b810e5786bfd0c98adabc654362b2d","first_seen":"2025-09-17T11:27:36.868673Z","last_seen":"2026-08-05T14:56:46.833032Z","times_seen":11083,"resource_available":false,"data":null}},"time_used":313,"timings":{"blocked":120,"dns":3,"connect":22,"send":0,"wait":59,"receive":0,"ssl":107},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crimsonmods.com/img/installation.jpg","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"ip":{"addr":"80.66.84.114","port":443,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:17.858Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crimsonmods.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Mar 2026 02:48:54 GMT","end":"Wed, 17 Jun 2026 02:48:53 GMT"},"fingerprint":{"sha1":"FB:92:B1:B7:C1:EE:41:2A:70:B2:23:45:C9:9B:C0:B6:AD:91:FC:80","sha256":"3C:42:B3:D8:87:21:D9:6F:A7:A0:B9:4D:52:0A:AA:D4:6F:19:EC:8C:03:20:8F:9B:3C:05:7F:27:57:26:B9:84"}}},"request":{"raw":"GET /img/installation.jpg HTTP/1.1\r\nHost: crimsonmods.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Thu, 26 Mar 2026 22:40:18 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Mon, 18 Aug 2025 11:18:32 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68a30c08-d4b77\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":871287,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=3, xresolution=50, yresolution=58, resolutionunit=2], progressive, precision 8, 2400x2600, components 3","md5":"319e46a38b20fa1308eec5bfd75bea85","sha1":"b31fb50f6c107ae8bb8c295172c2f714ba34debf","sha256":"d985e5c00cf2bfeb824b9bc6800a8bb999d81f063f540173a405f27e5c97e66e","sha512":"61d35612451cc8a79a59eb03f7b27fef758b6b5e7ce022557f2c2d51cfbea7cc85c8ac31fcc8d005c60527f753f9a45e0cca0499be70a184dfc298af38a9af57","ssdeep":"24576:M3DkIvF951uDqvhgXXh4FdAL3QNZLqbuzxh8p:MpNYDKhfFUgv9o","tlshash":"490523eb5b0410cbd45cfb76ca895f0ee0e7583584a1b2b9951b861d60e331bdf9850e","first_seen":"2026-01-11T14:19:38.516724Z","last_seen":"2026-03-26T22:40:47.736017Z","times_seen":2,"resource_available":false,"data":null}},"time_used":410,"timings":{"blocked":177,"dns":0,"connect":0,"send":0,"wait":67,"receive":166,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crimsonmods.com/js/join-to-panel.js","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"ip":{"addr":"80.66.84.114","port":443,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:17.863Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crimsonmods.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Mar 2026 02:48:54 GMT","end":"Wed, 17 Jun 2026 02:48:53 GMT"},"fingerprint":{"sha1":"FB:92:B1:B7:C1:EE:41:2A:70:B2:23:45:C9:9B:C0:B6:AD:91:FC:80","sha256":"3C:42:B3:D8:87:21:D9:6F:A7:A0:B9:4D:52:0A:AA:D4:6F:19:EC:8C:03:20:8F:9B:3C:05:7F:27:57:26:B9:84"}}},"request":{"raw":"GET /js/join-to-panel.js HTTP/1.1\r\nHost: crimsonmods.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Thu, 26 Mar 2026 22:40:17 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 214\r\nLast-Modified: Wed, 02 Jul 2025 20:53:42 GMT\r\nConnection: keep-alive\r\nETag: \"68659c56-d6\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":214,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"e34de8eb2888a86add62f4afa8f8cf71","sha1":"a100f9c444c0df26174b79eea42ea3ad4638e18e","sha256":"e2308d6f1a7369d8ac81d531549e1d763508ad3f595d4a8d48811ff6cf9ff5e6","sha512":"fa2ad443b014c5fd64e8d834fab4f7c8d4a70bbee8732c5a67f1b484f7f1df2d0b5a53da7039976db10003de438cfb84c681d926aac6bee7b41dc5766c0dfddb","ssdeep":"","tlshash":"f9d02220d8182de2803eb3bcaf26e890b9371de2d00461013e1c4e1caf3002f877af54","first_seen":"2025-06-16T19:42:38.975387Z","last_seen":"2026-07-20T13:44:28.696303Z","times_seen":61,"resource_available":true,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":1,"connect":20,"send":0,"wait":20,"receive":0,"ssl":41},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/poppins/v24/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:18.142Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/poppins/v24/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://crimsonmods.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 7748\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 25 Mar 2026 18:54:16 GMT\r\nexpires: Thu, 25 Mar 2027 18:54:16 GMT\r\ncache-control: public, max-age=31536000\r\nage: 99962\r\nlast-modified: Mon, 15 Sep 2025 16:36:26 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":7748,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 7748, version 1.0","md5":"a09f2fccfee35b7247b08a1a266f0328","sha1":"0da2d17e738f46d2a09e6fb7969da451719a9820","sha256":"cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446","sha512":"5e3f9a298003b84250ec6801e08ad2a4ff8845d4c3e13ea61bec37da24d26ede13b436257882124cc0c27e9a323ba92e7d23c6ad3f48a7b75535f5ed98813a0e","ssdeep":"96:0g6vAF/FXh6MmoI56TEwosGU/DbVF/QBT1gaHEYT6u/w3hXLbJPAS772+6haAftj:zp6x6TYpoDYBJg8TRkbJPAS/2+CzQa7","tlshash":"f3f19de65d1e5e8980f0102f6f6efce767950d88141dadf9a9e72f884c6ba1b04c90cd","first_seen":"2023-04-05T13:48:05Z","last_seen":"2026-08-05T19:03:38.695264Z","times_seen":272591,"resource_available":true,"data":null}},"time_used":357,"timings":{"blocked":169,"dns":1,"connect":24,"send":0,"wait":9,"receive":1,"ssl":150},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crimsonmods.com/favicons/favicon.svg","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"ip":{"addr":"80.66.84.114","port":443,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:18.562Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crimsonmods.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Mar 2026 02:48:54 GMT","end":"Wed, 17 Jun 2026 02:48:53 GMT"},"fingerprint":{"sha1":"FB:92:B1:B7:C1:EE:41:2A:70:B2:23:45:C9:9B:C0:B6:AD:91:FC:80","sha256":"3C:42:B3:D8:87:21:D9:6F:A7:A0:B9:4D:52:0A:AA:D4:6F:19:EC:8C:03:20:8F:9B:3C:05:7F:27:57:26:B9:84"}}},"request":{"raw":"GET /favicons/favicon.svg HTTP/1.1\r\nHost: crimsonmods.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Thu, 26 Mar 2026 22:40:18 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 15254\r\nLast-Modified: Wed, 02 Jul 2025 20:53:33 GMT\r\nConnection: keep-alive\r\nETag: \"68659c4d-3b96\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15254,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"10e5e82255daba61b81bcb836b7ef316","sha1":"d102ce552e1be84f844a45614656e32004a92f78","sha256":"e07308feb9445fd56dd8f95131bc919ec0ad8a8d221b68d15bcfeec85cab9017","sha512":"a34549c2d2b71e43a277af674963ff3c0ca1213b71f00d197210efb34bb54643e277c1ef535f42771f1066c55b899b30e1dab029e2b55b5a0979ac03bc3c9c6e","ssdeep":"384:0IycSV9WYVyQ2yPdQoNLUCnxlpr1uIIJQ2K+5PuQ:acYunoNLU071QQxOj","tlshash":"0562c07b1622a88f876d55282e3d78197a1ff8ce00780b6bc25d77ce3d4c5a8535c18e","first_seen":"2025-06-16T19:42:38.980073Z","last_seen":"2026-06-21T03:56:14.820534Z","times_seen":52,"resource_available":false,"data":null}},"time_used":228,"timings":{"blocked":204,"dns":0,"connect":0,"send":0,"wait":23,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crimsonmods.com/css/styles.css","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"ip":{"addr":"80.66.84.114","port":443,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:17.844Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crimsonmods.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Mar 2026 02:48:54 GMT","end":"Wed, 17 Jun 2026 02:48:53 GMT"},"fingerprint":{"sha1":"FB:92:B1:B7:C1:EE:41:2A:70:B2:23:45:C9:9B:C0:B6:AD:91:FC:80","sha256":"3C:42:B3:D8:87:21:D9:6F:A7:A0:B9:4D:52:0A:AA:D4:6F:19:EC:8C:03:20:8F:9B:3C:05:7F:27:57:26:B9:84"}}},"request":{"raw":"GET /css/styles.css HTTP/1.1\r\nHost: crimsonmods.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Thu, 26 Mar 2026 22:40:17 GMT\r\nContent-Type: text/css\r\nLast-Modified: Mon, 18 Aug 2025 11:05:48 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68a3090c-a28f\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41615,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"106b9194dc7d124924b9c8be828ad67d","sha1":"433fb436042c2f3eea9326c072946f5ae8747bcd","sha256":"302668142de76577eced00365f36e67c4ad0fe1ef799d503ba7d75779bb2e916","sha512":"6e21cf79027704a92b6f850d5e4f593fa58e705b41b38343f66ed84bdcb43fffea59084830acb27f655b4bbc3e2679bff5667410898c578b29de6040dc010652","ssdeep":"192:rD0UlZqbsSPsYMOGbo0xaZ9IetgH2Y43j2KaPj9GWcD5igWeGSe7qc4MV/uTHfu7:ru75WTlaoWX4","tlshash":"7813015cd61212536237e7789ff24709f7a490639e0142be3add22458ffa2bc8162edd","first_seen":"2026-01-11T14:19:38.508954Z","last_seen":"2026-03-26T22:40:47.747961Z","times_seen":3,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crimsonmods.com/img/video-poster.jpg","fqdn":"crimsonmods.com","domain":"crimsonmods.com","tld":"com"},"ip":{"addr":"80.66.84.114","port":443,"asn":63023,"as":"AS-GLOBALTELEHOST","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:17.852Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crimsonmods.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Mar 2026 02:48:54 GMT","end":"Wed, 17 Jun 2026 02:48:53 GMT"},"fingerprint":{"sha1":"FB:92:B1:B7:C1:EE:41:2A:70:B2:23:45:C9:9B:C0:B6:AD:91:FC:80","sha256":"3C:42:B3:D8:87:21:D9:6F:A7:A0:B9:4D:52:0A:AA:D4:6F:19:EC:8C:03:20:8F:9B:3C:05:7F:27:57:26:B9:84"}}},"request":{"raw":"GET /img/video-poster.jpg HTTP/1.1\r\nHost: crimsonmods.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Thu, 26 Mar 2026 22:40:18 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Wed, 02 Jul 2025 20:53:34 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68659c4e-295ff\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":169471,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x720, components 3","md5":"bae720927e17348e6a973d36745e1328","sha1":"67ea505473a040ca2102580e0eddb69799403c74","sha256":"0e7fdf9f7030308a1e747aa3dd390e35b3dbb18d5f27e07ac741411e7096a6d2","sha512":"baef6e27c4cfca31dea6097252bd117d09f3f64036a0b18137feb199250d16b9621c4b9ffe814cfa00d732c7f76b1e127175e9e598f5ed5f44bc55ad2d506170","ssdeep":"3072:Rdj3si1aZNqVl0j5A1eiuYJ/KJeOhzYWRbKSHKhS02gVEIZgsn49j:Rdj3sEanqVWVA1eiT/KJ5hkWRWiTPg+h","tlshash":"cff31256827da9c851a23bb8cb7228617492480dfffed1f587352de6bccf481964c827","first_seen":"2025-07-02T17:56:33.550679Z","last_seen":"2026-06-21T03:56:14.827088Z","times_seen":25,"resource_available":false,"data":null}},"time_used":306,"timings":{"blocked":184,"dns":0,"connect":0,"send":0,"wait":41,"receive":81,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-26","alert":"Sinkholed","trigger":"crimsonmods.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/mDLb28y.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:17.853Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 13 Feb 2026 00:00:00 GMT","end":"Mon, 15 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D4:9A:34:EF:13:3D:45:98:6B:98:4B:9D:CD:FC:74:9C:06:42:A0:7A","sha256":"90:50:0F:E4:90:40:B5:50:04:7E:E1:6E:55:14:FE:7B:38:BB:79:2B:70:83:78:AC:16:E0:F7:1E:3D:ED:92:9A"}}},"request":{"raw":"GET /mDLb28y.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Fri, 26 Dec 2025 09:57:53 GMT\r\netag: \"88d85f9ef06bc3e6df0e59d7dd0a40ca\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: us4ITgfCdfJ2sX-vLSUZsi8MG7pBbWDjqc15xwDnl1FNQJrV0y7GJw==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nage: 281530\r\ndate: Thu, 26 Mar 2026 22:40:18 GMT\r\nx-served-by: cache-iad-kjyo7100067-IAD, cache-hel1410028-HEL\r\nx-cache: Miss from cloudfront, HIT, MISS\r\nx-cache-hits: 19, 0\r\nx-timer: S1774564818.910948,VS0,VE108\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 757378\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":757378,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 720, 8-bit/color RGB, non-interlaced","md5":"88d85f9ef06bc3e6df0e59d7dd0a40ca","sha1":"d48aec56bb1e54bec3f62b988d406699d5693e7d","sha256":"54d77f00b3d4118a353d6b342a1548e37b12e7a7e5e3c08bff8cbade62dcd86a","sha512":"6601d4c3756b5b174c837cc36dc5e40a57fd8b7133b2a44a276bfc483e0af71732d79f9cd371ce387dba40da58ed6eb17f1477a37b6bb3bf8d81a7c307a7d03e","ssdeep":"12288:tfFDp0v/fpNlJ8cCnDBs+gexI3li9/qMP2Ed7xAVhd+lIoSzH8fyh1:tfFDyHRDBCD/N2oVq42EZCVX+8zH8KT","tlshash":"a0f4238a59fdc1de22192acdc481db6ef0d5f365af0202cb9c279f370959a9cd10a973","first_seen":"2026-01-11T14:19:38.511702Z","last_seen":"2026-03-26T22:40:47.753019Z","times_seen":3,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":50,"dns":0,"connect":0,"send":0,"wait":133,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/s5yoN0P.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crimsonmods.com/","date":"2026-03-26T22:40:17.855Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Fri, 13 Feb 2026 00:00:00 GMT","end":"Mon, 15 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D4:9A:34:EF:13:3D:45:98:6B:98:4B:9D:CD:FC:74:9C:06:42:A0:7A","sha256":"90:50:0F:E4:90:40:B5:50:04:7E:E1:6E:55:14:FE:7B:38:BB:79:2B:70:83:78:AC:16:E0:F7:1E:3D:ED:92:9A"}}},"request":{"raw":"GET /s5yoN0P.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://crimsonmods.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Thu, 18 Dec 2025 11:39:31 GMT\r\netag: \"8c4e1ed10a1319dcae627743abe7b4d9\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: 3uwXiKpqGTz4UQlASj7r1l5TGKXNfmPCIAJy3q9mTT2GY_Oey3RchQ==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\ndate: Thu, 26 Mar 2026 22:40:17 GMT\r\nage: 287004\r\nx-served-by: cache-iad-kiad7000103-IAD, cache-hel1410028-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 26, 1\r\nx-timer: S1774564818.910391,VS0,VE3\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 659963\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":659963,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 720, 8-bit/color RGB, non-interlaced","md5":"8c4e1ed10a1319dcae627743abe7b4d9","sha1":"4a5a2ef92fbb0cb4a5b62109127b567568dee932","sha256":"6e62bf6bb82de9f4e95206c42b69933f8912f351c7a1380af70735689e217eb2","sha512":"ed82e18b9fff159dfb067093e67d531bb40e124ae0f69da7d95fa28f51379e3e66bc5d26d0f6ce005d8ccabd2c3b34baf08237cae5596fd2a0fca8be775decaf","ssdeep":"12288:tDMSenL1XWuIcbORO7TAmlxK1iNrShB7ZFdf7OcP1feZU:tCQuIcCRoTAmG1iNSL7ZFP","tlshash":"cae423b0891268c9fc296d2f8643f0bab522e3eb935617474b435fb4df4651ab8084df","first_seen":"2026-01-11T14:19:38.541865Z","last_seen":"2026-04-15T00:29:26.214853Z","times_seen":9,"resource_available":false,"data":null}},"time_used":173,"timings":{"blocked":47,"dns":0,"connect":0,"send":0,"wait":46,"receive":80,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}