{"report_id":"21d1f2dd-dde9-4a6c-9a0b-ee7e06e29cbd","version":0,"status":"done","tags":[],"date":"2026-08-19T22:24:50Z","url":{"schema":"http","addr":"142cee.ralind.at/referal/zipo1hs.php","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":0,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"final":{"url":{"schema":"https","addr":"142cee.ralind.at/referal/zipo1hs.php","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"title":"Binance","dom":{"size":48185,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (12462)","md5":"79b0b0d514ddf874e4c3c6b22b91d1d5","sha1":"e17b6833a3d91680cef77292feeead7ccd5a647d","sha256":"c5f8949eac472c4786223a9ceb0550bae759f419032bd4330beff54a163e09fd","sha512":"6a0239d14ce51136917803f0d7590b6a04721c0231da20e4904eba7949acbc8d06ba903f298670703275c5ac14b422eb643dc0dd55c81b7d0c5380370007a3ef","ssdeep":"768:D7sFhn8+R9am6KXAhD+LYfeyCPu8wLT04i:Yh8WYf5CPuTs","tlshash":"3a23e719a2f1023f1e5380fab79a6b1d33a4b143de16d6557aad01226fc7ff2489324c","dom_hash":"domhashbcaf7c9b23d51145865dc07e73fdc394","first_seen":"2026-08-19T22:24:55.475274Z","last_seen":"2026-08-19T22:24:55.475274Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"142cee.ralind.at/referal/zipo1hs.php","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":0,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-23T22:24:50Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-19","alert":"Phishing Block","trigger":"142cee.ralind.at","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"images.ctfassets.net","ip":{"addr":"108.157.229.8","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2017-03-28","domain_rank":23334,"first_seen":"2017-09-20T16:27:05Z","last_seen":"2026-08-13T19:03:21.902044Z","alert_count":0,"request_count":3,"received_data":504592,"sent_data":1924,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"cdn.tailwindcss.com","ip":{"addr":"104.26.2.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2017-07-20","domain_rank":117330,"first_seen":"2018-07-09T05:46:13Z","last_seen":"2026-08-17T09:01:37.054148Z","alert_count":0,"request_count":2,"received_data":408713,"sent_data":938,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-08-16T22:46:07.924415Z","alert_count":0,"request_count":3,"received_data":287510,"sent_data":1758,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"142cee.ralind.at","ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-19T00:55:09.468462Z","last_seen":"2026-08-19T00:55:09.468462Z","alert_count":30,"request_count":10,"received_data":95619,"sent_data":5120,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Contentful","description":"Contentful is an API-first content management platform to create, manage and publish content on any digital channel.","website":"https://www.contentful.com","common_platform_enumeration":"","icon":"Contentful.svg","categories":["CMS"]},{"name":"Tailwind CSS","description":"Tailwind is a utility-first CSS framework.","website":"https://tailwindcss.com/","common_platform_enumeration":"","icon":"tailwindcss.svg","categories":["UI frameworks"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"142cee.ralind.at/referal/js/placeholder.js","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"4d8663f580217a26ef129cb80489078d","sha1":"d52b1a89d0a8ddfec448a5e74ff1d4c00335724c","sha256":"6caedafd637772a8543db1eebb0a2d5bf8b764ce4926aaa75ae9be9cb5ca55fc","sha512":"00c301a6e4169f0e8cf0320efdc93397107d18ef983582c262c7662aa7312963d6e115acbfe5d8e8c70c490b18fdfaeacaf6bbec100934d0900a90c7856ee9b9","ssdeep":"","tlshash":"0ae020291325c11506b2c77272b05e48b579856f5a418087373d451cfff19cfe456de1","size":377,"data":"","first_seen":"2025-09-20T04:38:13.879676Z","last_seen":"2026-08-19T22:24:55.489503Z","times_seen":45,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/zipo1hs.php","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":true,"md5":"b684d78315482fe5410017ad91d72e4d","sha1":"81d4a769c17732d2d274a7d22194af85ff45d70f","sha256":"86df12dedab68ef41993c717ec41fd03689018959473f92a0214dc90c29a5e50","sha512":"6d06afb960462aa24921b3e566621aced351837805e14cef50b2fd75a414c8ad4de64dac9914b61ea171a72ba8bc3580b0fddd00d745c846dd1832d07926ee17","ssdeep":"","tlshash":"72c04c54cf174e5f3e10e4b0e33963872dd4484e6540f6453a54f5175c4dd03a47a4d7","size":145,"data":"","first_seen":"2026-08-19T00:55:14.992602Z","last_seen":"2026-08-19T22:24:55.497397Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/zipo1hs.php","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":true,"md5":"86a66a50d2148a70ed054735d2762607","sha1":"07a00f4e83b30d51c052ef6a5d01b8335be59bb9","sha256":"b59cc579440abebe2692912eeea10cca784f4a980aeb9a57eeba8611b2d8978e","sha512":"a3ab54fb08767f1c0e7dacf4b7177be14fd8839502b3d512baf500a1be2d7538d50ff13640d212d76534830d672ca0404ca50fed11586a0f058e13cd742fbea6","ssdeep":"","tlshash":"b651ec3266a6083641a769eb27cf970e3b39a50bd142d907be1c66090fa3d5058e37f9","size":2635,"data":"","first_seen":"2026-08-19T00:55:14.993746Z","last_seen":"2026-08-19T22:24:55.499383Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/zipo1hs.php","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":true,"md5":"8dd9f531459bd9848e843fcf297230ed","sha1":"f092f40c805c12fea050b766f90bc02911bc9be5","sha256":"ae31bef3f010e1c140e17c56fcfa2a7c64ab69d2d0f90a859e94d39f623a7aab","sha512":"8524151f2aef1375d2ce5b4c70d360485998b9a598da1d276aecb6918e8fd73db504c73cf0cf57545ef9d60e77ac6fc7ea2fb6d260b063e5313309a507f54afa","ssdeep":"","tlshash":"e321ad37332f082047d755ba769763c67434b503f801d25f3a9d82924fa7e8aa0f66c9","size":1230,"data":"","first_seen":"2026-08-19T00:55:14.994768Z","last_seen":"2026-08-19T22:24:55.501381Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/zipo1hs.php","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":true,"md5":"8833798cdc197c1b8922738fd611dcfe","sha1":"38ef589333f2ea062a15b284c767c1c77ad4a1bb","sha256":"825e22a5b100e84c7e5aed156f009e2b267fabd9daa53775be3214e26dc28d22","sha512":"d224bd0455d319040ef8263edab86b3edbf2590ce8031c75f7c51ab55a9438b2c44f222190bab55cef39e9ff8856ed27e54aec05ba439a94bc93797e765a527c","ssdeep":"96:vy02t5ornKmFCoEmy7TkRmIojfpWfJ+JxClLFDnnkjWdG9AmjtYcF0QJaWSNp:602t5oePBmakRForcfJPAUO2cSPWSNp","tlshash":"32e1935890330734c21716bd67fb0a0921e991133a12db517d8e655a1f0bfada2ebfdc","size":7212,"data":"","first_seen":"2026-08-19T00:55:14.995896Z","last_seen":"2026-08-19T22:24:55.503529Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/zipo1hs.php","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":true,"md5":"b738baa0fdf575833f75a8fe7bf8e500","sha1":"2318cb35560c15893e1e878f092f15ea506edbab","sha256":"f5b853358f34d6e31eb045d57ee30d8e1c2552dfe6eb348c9796e5634cf34a23","sha512":"5ddda7c6fd32d7b6c075b562ba327b16c4b742c48ade88536326a7a28e9081d9d1abb72270246b4a7673aa7d19c31876638c7f7159c1154715d3b053e74446d6","ssdeep":"","tlshash":"4c51ef13b0560aa686629cfa73c7330b727490017846d355fd6c06066febe466df2adf","size":2892,"data":"","first_seen":"2026-06-08T14:57:06.322402Z","last_seen":"2026-08-19T22:24:55.506506Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/js/redirect.js","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"159ee73884df8d20687a1dca38c93cbf","sha1":"5dc380501d9f9762a07e81022a60039c9a9b0a5d","sha256":"4548b08ae3988444628cd753a8a9cfbe1c9698ecaf8ffe6470f1515b16f703d4","sha512":"28895f6aee089af09b7280ab3f3bea2420e9d1475d94c90d8eb842d0fadd3c2e420434f18f1ff00ba9aafb5bdab85e2ffc879073b318695e06d9e4ee68998226","ssdeep":"96:/UHbNFNmN+i1hBpOlj6lKyF23riCfgaDVxUQA9:/b1hBjt2/Vq","tlshash":"0891fbdda1b3c8583acb54362c4b140a7d36121b184ae821bfce56902f5063ed3b7d9b","size":4309,"data":"","first_seen":"2025-09-20T17:56:06.840321Z","last_seen":"2026-08-19T22:24:55.486251Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.2.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","size":407279,"data":"","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-08-20T02:24:58.562885Z","times_seen":49914,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"warn","text":"cdn.tailwindcss.com should not be used in production. To use Tailwind CSS in production, install it as a PostCSS plugin or use the Tailwind CLI: https://tailwindcss.com/docs/installation","filename":"https://cdn.tailwindcss.com/","line_number":64,"column_number":1711}]},"http":[{"url":{"schema":"https","addr":"142cee.ralind.at/referal/img/logoB.png","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:11.864Z","timestamp":1787178251864,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ralind.at","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 09:54:21 GMT","end":"Tue, 06 Oct 2026 09:54:20 GMT"},"fingerprint":{"sha1":"A0:B5:3F:5D:A6:FB:DD:64:0F:DF:90:18:78:FF:24:0A:7E:4D:A3:FE","sha256":"14:AA:A6:EE:B5:A7:60:65:06:58:72:44:8F:B2:16:25:B1:8E:79:16:6A:51:02:F3:E3:B8:D0:E4:5A:40:FB:0B"}}},"request":{"raw":"GET /referal/img/logoB.png HTTP/1.1\r\nHost: 142cee.ralind.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://142cee.ralind.at/referal/zipo1hs.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 19 Aug 2026 22:24:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 19948\r\nLast-Modified: Thu, 23 Apr 2026 01:49:22 GMT\r\nConnection: keep-alive\r\nETag: \"69e97aa2-4dec\"\r\nExpires: Thu, 20 Aug 2026 22:24:12 GMT\r\nCache-Control: max-age=86400\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19948,"size_decoded":20252,"mime_type":"image/png","magic":"PNG image data, 250 x 250, 8-bit/color RGBA, non-interlaced","md5":"af037533c2b7de00930a9f5527e1d060","sha1":"5fc1e694ca46000c82d56cf102b7a7e830da1125","sha256":"33e20a989cd04ef0a38ac7b9222b53b859530e5b9c53d06cf224cf8b23abc684","sha512":"a00884ffc3dc13e8382d33625d60a94b4cb4978d224b51afd0cad2868de184eb6018e30904ae67525bc7041c3ba4783a391429b99dddcf1346546c30a0abde9c","ssdeep":"384:ir4i64jwvLIOBEPycd5mMN1P+L2YuCrS+kJHACNQH8IO7bmz2lT:ir4i64Q8OBPc7P+6Yu2kJHAMVa2lT","tlshash":"9892e12925689cca7238f342b9de9d6cc19f16e1bc89a970e617f7513800bcedc13607","first_seen":"2025-09-20T04:38:14.01608Z","last_seen":"2026-08-19T22:24:55.479333Z","times_seen":65,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":123,"dns":0,"connect":0,"send":0,"wait":58,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-19","alert":"Phishing Block","trigger":"142cee.ralind.at","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/img/tutorial-step-one-dark-lg-a.png","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:11.867Z","timestamp":1787178251867,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ralind.at","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 09:54:21 GMT","end":"Tue, 06 Oct 2026 09:54:20 GMT"},"fingerprint":{"sha1":"A0:B5:3F:5D:A6:FB:DD:64:0F:DF:90:18:78:FF:24:0A:7E:4D:A3:FE","sha256":"14:AA:A6:EE:B5:A7:60:65:06:58:72:44:8F:B2:16:25:B1:8E:79:16:6A:51:02:F3:E3:B8:D0:E4:5A:40:FB:0B"}}},"request":{"raw":"GET /referal/img/tutorial-step-one-dark-lg-a.png HTTP/1.1\r\nHost: 142cee.ralind.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://142cee.ralind.at/referal/zipo1hs.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 19 Aug 2026 22:24:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 9944\r\nLast-Modified: Thu, 23 Apr 2026 01:49:22 GMT\r\nConnection: keep-alive\r\nETag: \"69e97aa2-26d8\"\r\nExpires: Thu, 20 Aug 2026 22:24:12 GMT\r\nCache-Control: max-age=86400\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9944,"size_decoded":10247,"mime_type":"image/png","magic":"PNG image data, 360 x 192, 8-bit/color RGBA, non-interlaced","md5":"1bdf53d09b681695e251d9de160177a4","sha1":"c08193877febc6109b213612d7c5732e100d7a0b","sha256":"984bf23e1221dcfd25c4e7a967852f1733a17999d35d3ea7efc6d80306924fea","sha512":"0a40f725c6a248cf48154a2469b683ffb80644f7627cdf7f48ce47f078cc08ab797c6b1c04ab387841ad57ffe02f7374ca232b7d4512c7a0cc308744e0a1bd2d","ssdeep":"192:bSBgUhjShdIdldnOTyZPyst2jaTCxbW11YZKFhvuAZJrPH0/JKmRd:OBxhqH+ZPV2WCSkhWJrveJKmf","tlshash":"8d228cc25f96842c97b7efcc8d4e2b73fb319e87c28cae45df19243a53854a95a17001","first_seen":"2025-09-20T04:38:14.103484Z","last_seen":"2026-08-19T22:24:55.482743Z","times_seen":6,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":123,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-19","alert":"Phishing Block","trigger":"142cee.ralind.at","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/img/tutorial-step-three-dark-lg-a.png","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:11.871Z","timestamp":1787178251871,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ralind.at","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 09:54:21 GMT","end":"Tue, 06 Oct 2026 09:54:20 GMT"},"fingerprint":{"sha1":"A0:B5:3F:5D:A6:FB:DD:64:0F:DF:90:18:78:FF:24:0A:7E:4D:A3:FE","sha256":"14:AA:A6:EE:B5:A7:60:65:06:58:72:44:8F:B2:16:25:B1:8E:79:16:6A:51:02:F3:E3:B8:D0:E4:5A:40:FB:0B"}}},"request":{"raw":"GET /referal/img/tutorial-step-three-dark-lg-a.png HTTP/1.1\r\nHost: 142cee.ralind.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://142cee.ralind.at/referal/zipo1hs.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 19 Aug 2026 22:24:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 7799\r\nLast-Modified: Thu, 23 Apr 2026 01:49:22 GMT\r\nConnection: keep-alive\r\nETag: \"69e97aa2-1e77\"\r\nExpires: Thu, 20 Aug 2026 22:24:12 GMT\r\nCache-Control: max-age=86400\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7799,"size_decoded":8102,"mime_type":"image/png","magic":"PNG image data, 360 x 192, 8-bit/color RGBA, non-interlaced","md5":"5e34df3fdca16bc584c7a899995f3b23","sha1":"4c78f2bfaf1df9319c44aa56d9f0c1189a1ec327","sha256":"4ae3c2b7ce836657bf3c1a93781ed7ff6223153c85aa9ffd3d1291c496afb8f7","sha512":"655aef66e7df5780cea5a73bf8186fbc2a500753e37b13a114844ceffadcb13f6e5f597f711fc44870ef8a63fabc91f8b0eba7fb05ac1f59b0419ec0d65eee9d","ssdeep":"192:bS422xOgrl59ayyRzRkFmNVRiF9ksiCjuS3PtE:O7N07OIsVRirViJS6","tlshash":"56f18ebf9257b339ca345a03395033a913fbd95b858b9563c49f6b39cd0368c2a511ce","first_seen":"2025-09-20T04:38:13.900047Z","last_seen":"2026-08-19T22:24:55.483593Z","times_seen":6,"resource_available":false,"data":null}},"time_used":172,"timings":{"blocked":123,"dns":0,"connect":33,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-19","alert":"Phishing Block","trigger":"142cee.ralind.at","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"images.ctfassets.net/o10es7wu5gm1/0qknCMqpf9DTGUAgtyJZU/b0d4de069c1987e5e7d2dc1dc7db546c/Rewards_Sample.png?fm=avif\u0026w=800\u0026h=800\u0026q=65","fqdn":"images.ctfassets.net","domain":"ctfassets.net","tld":"net"},"ip":{"addr":"108.157.229.8","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:11.872Z","timestamp":1787178251872,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"images.ctfassets.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Sat, 18 Oct 2025 00:00:00 GMT","end":"Sun, 15 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"3E:39:C1:37:7A:6B:60:8A:D5:73:9E:D7:C4:F9:3A:11:9B:BD:94:2B","sha256":"AC:EA:37:10:54:C2:91:B5:04:B8:B4:CA:CD:35:48:4D:D0:92:78:F6:E2:8B:D9:57:78:20:D6:74:FE:14:16:A9"}}},"request":{"raw":"GET /o10es7wu5gm1/0qknCMqpf9DTGUAgtyJZU/b0d4de069c1987e5e7d2dc1dc7db546c/Rewards_Sample.png?fm=avif\u0026w=800\u0026h=800\u0026q=65 HTTP/1.1\r\nHost: images.ctfassets.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://142cee.ralind.at/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: image/avif\r\ncontent-length: 10429\r\nlast-modified: Wed, 05 Aug 2026 11:20:21 GMT\r\nserver: Contentful Images API\r\naccess-control-allow-origin: *\r\ndate: Wed, 19 Aug 2026 03:56:05 GMT\r\ncache-control: max-age=31536000\r\netag: \"be993a91ad42b094298cd06c9ea5788c\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 d009c4305a73ef1e26138117423d6076.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P2\r\nx-amz-cf-id: hO5FQ8_DeUOnnGlqsUE-cM8oxw8u95kubkJfh_Ma_JT3lMqi315svA==\r\nage: 66487\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":10429,"size_decoded":10965,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"be993a91ad42b094298cd06c9ea5788c","sha1":"d2a46d450754f532542feb056731da6f95ff2fc5","sha256":"a0667f3517e49b02b6dbcfc4eb3b529907959cbbdb940cff0c1fd77f37f1858d","sha512":"278c46eac2938d1255e7a5a109b368fdfd49d0b02d6e9fd2e72df2b00d4dcc519065c3ce2b2b2aa8d1852d5b3bb53adf9e3f72133d0cd1c5baef29287bbac3ab","ssdeep":"192:+zCRP/2Pg0p8wnc/aeCTgfwPrsbi6Of+U4wrmKu8rasXazfA4RJW:S/V8wn0/crSM+UjWqa1JW","tlshash":"bc22c0a633411907fcb908338c850037bf027e9ef21e989c79debd1b095739449f51a5","first_seen":"2025-08-18T14:27:54.586065Z","last_seen":"2026-08-19T22:24:55.484303Z","times_seen":70,"resource_available":false,"data":null}},"time_used":173,"timings":{"blocked":122,"dns":4,"connect":10,"send":0,"wait":14,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.ctfassets.net/o10es7wu5gm1/39vHxQi4GwoV79yNJk9Cdw/51d4a01ce806c2ad0111b43dcb5b1c73/Frame_316123440.png","fqdn":"images.ctfassets.net","domain":"ctfassets.net","tld":"net"},"ip":{"addr":"108.157.229.8","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:11.873Z","timestamp":1787178251873,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"images.ctfassets.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Sat, 18 Oct 2025 00:00:00 GMT","end":"Sun, 15 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"3E:39:C1:37:7A:6B:60:8A:D5:73:9E:D7:C4:F9:3A:11:9B:BD:94:2B","sha256":"AC:EA:37:10:54:C2:91:B5:04:B8:B4:CA:CD:35:48:4D:D0:92:78:F6:E2:8B:D9:57:78:20:D6:74:FE:14:16:A9"}}},"request":{"raw":"GET /o10es7wu5gm1/39vHxQi4GwoV79yNJk9Cdw/51d4a01ce806c2ad0111b43dcb5b1c73/Frame_316123440.png HTTP/1.1\r\nHost: images.ctfassets.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://142cee.ralind.at/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: image/png\r\ncontent-length: 474899\r\nlast-modified: Sun, 14 Jul 2024 21:32:58 GMT\r\nserver: Contentful Images API\r\naccess-control-allow-origin: *\r\ndate: Wed, 19 Aug 2026 04:52:11 GMT\r\ncache-control: max-age=31536000\r\netag: \"16b3015cea60ad72fd1e144fd20f8a87\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 d009c4305a73ef1e26138117423d6076.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P2\r\nx-amz-cf-id: 8AhCt5z9ky58YdHdqB0SPR4_3-GjD3QHedoug4GIoVcdEPry3wVK7A==\r\nage: 63122\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":474899,"size_decoded":475435,"mime_type":"image/png","magic":"PNG image data, 2160 x 2400, 8-bit/color RGBA, non-interlaced","md5":"16b3015cea60ad72fd1e144fd20f8a87","sha1":"016653ad6cb001412ffed3e19fca7dd05419527f","sha256":"3597d7ae8cb357405b58acf0b2ea71cf5cceb05a1b2a952f4c2afe2c73a43922","sha512":"09b558a7d7897f0395f8044254962a4fd803c1249b6f10319694288ab044ba7eb1fc61b17d20ffe2c60bd46a9c9295d46b734a2a1724fd772e1f560b280e10ab","ssdeep":"12288:x1D83KWzAbg7OYC+f7aFll77Wvc7zZRT/DV5G+rxiyWwXD4QGM:x1DEKWkbPLwuFb7757tRTDVcwiZwXDv","tlshash":"67a4122916eb0f83fd29507240e92bf37b6a449390704e96f7a974097f87eb4fa13614","first_seen":"2023-08-19T13:25:22Z","last_seen":"2026-08-19T22:24:55.485018Z","times_seen":74,"resource_available":false,"data":null}},"time_used":431,"timings":{"blocked":122,"dns":4,"connect":12,"send":0,"wait":11,"receive":46,"ssl":234},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.ctfassets.net/o10es7wu5gm1/4gA2dn0z5sAKVsMdQJcMal/8af1b0d921ffa52fb3d396a02bbcb041/1200_x_1200_white_bg.png?fm=avif\u0026w=1200\u0026h=1200\u0026q=65","fqdn":"images.ctfassets.net","domain":"ctfassets.net","tld":"net"},"ip":{"addr":"108.157.229.8","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:11.874Z","timestamp":1787178251874,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"images.ctfassets.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Sat, 18 Oct 2025 00:00:00 GMT","end":"Sun, 15 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"3E:39:C1:37:7A:6B:60:8A:D5:73:9E:D7:C4:F9:3A:11:9B:BD:94:2B","sha256":"AC:EA:37:10:54:C2:91:B5:04:B8:B4:CA:CD:35:48:4D:D0:92:78:F6:E2:8B:D9:57:78:20:D6:74:FE:14:16:A9"}}},"request":{"raw":"GET /o10es7wu5gm1/4gA2dn0z5sAKVsMdQJcMal/8af1b0d921ffa52fb3d396a02bbcb041/1200_x_1200_white_bg.png?fm=avif\u0026w=1200\u0026h=1200\u0026q=65 HTTP/1.1\r\nHost: images.ctfassets.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://142cee.ralind.at/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: image/avif\r\ncontent-length: 17656\r\nlast-modified: Mon, 17 Aug 2026 01:39:36 GMT\r\nserver: Contentful Images API\r\naccess-control-allow-origin: *\r\ndate: Wed, 19 Aug 2026 05:34:14 GMT\r\ncache-control: max-age=31536000\r\netag: \"648b3186b333b1fff9d7aa4afd1dae5d\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 d009c4305a73ef1e26138117423d6076.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P2\r\nx-amz-cf-id: 8yZetUeBVe8L1tkvWH1rfJ_BYNrgoVqVaKTIVJwlNfu1wv_PX8u6cw==\r\nage: 60598\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":17656,"size_decoded":18192,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"648b3186b333b1fff9d7aa4afd1dae5d","sha1":"d6438a7b55ef1c262f3e4cccf540ab16650f1860","sha256":"0d410ba3510ee2e9d1204b8f3c7848afd43802a55bd6e62adf1eef382867a7d5","sha512":"325dd4f9e1f7a0f07304d78ee2a6a568bd4862bc67b39c7e9ae9ac5e065c2bf2c30531a3ad0d99d5330ba8e4cee01cefbbb2c3564b8b7a0484e04018ec2c0105","ssdeep":"384:SiLzMF43p4pFBzX25lPL22fcWm7kx8rp1zYDe8JVAh:TfMG3p4Bj2vTzfvm7k2jUJVq","tlshash":"3e82d1d245490dafcfcd2b78af0a573160f28c659fefa203514a11419c22fd9e44ef4a","first_seen":"2025-08-18T14:27:54.588071Z","last_seen":"2026-08-19T22:24:55.485645Z","times_seen":73,"resource_available":false,"data":null}},"time_used":425,"timings":{"blocked":122,"dns":4,"connect":12,"send":0,"wait":11,"receive":40,"ssl":236},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/js/redirect.js","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:11.844Z","timestamp":1787178251844,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ralind.at","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 09:54:21 GMT","end":"Tue, 06 Oct 2026 09:54:20 GMT"},"fingerprint":{"sha1":"A0:B5:3F:5D:A6:FB:DD:64:0F:DF:90:18:78:FF:24:0A:7E:4D:A3:FE","sha256":"14:AA:A6:EE:B5:A7:60:65:06:58:72:44:8F:B2:16:25:B1:8E:79:16:6A:51:02:F3:E3:B8:D0:E4:5A:40:FB:0B"}}},"request":{"raw":"GET /referal/js/redirect.js HTTP/1.1\r\nHost: 142cee.ralind.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://142cee.ralind.at/referal/zipo1hs.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 19 Aug 2026 22:24:11 GMT\r\nContent-Type: application/javascript; charset=UTF-8\r\nLast-Modified: Thu, 23 Apr 2026 01:49:22 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69e97aa2-10d5\"\r\nExpires: Thu, 20 Aug 2026 22:24:11 GMT\r\nCache-Control: max-age=86400\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4309,"size_decoded":1844,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"159ee73884df8d20687a1dca38c93cbf","sha1":"5dc380501d9f9762a07e81022a60039c9a9b0a5d","sha256":"4548b08ae3988444628cd753a8a9cfbe1c9698ecaf8ffe6470f1515b16f703d4","sha512":"28895f6aee089af09b7280ab3f3bea2420e9d1475d94c90d8eb842d0fadd3c2e420434f18f1ff00ba9aafb5bdab85e2ffc879073b318695e06d9e4ee68998226","ssdeep":"96:/UHbNFNmN+i1hBpOlj6lKyF23riCfgaDVxUQA9:/b1hBjt2/Vq","tlshash":"0891fbdda1b3c8583acb54362c4b140a7d36121b184ae821bfce56902f5063ed3b7d9b","first_seen":"2025-09-20T17:56:06.840321Z","last_seen":"2026-08-19T22:24:55.486251Z","times_seen":8,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-19","alert":"Phishing Block","trigger":"142cee.ralind.at","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.2.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:11.846Z","timestamp":1787178251846,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tailwindcss.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 17 Jul 2026 20:38:38 GMT","end":"Thu, 15 Oct 2026 21:38:35 GMT"},"fingerprint":{"sha1":"AF:4F:AD:59:FA:ED:77:04:0D:32:56:48:B0:E5:1B:38:67:6D:7D:02","sha256":"E7:FC:CF:2D:6A:CC:F5:3C:4C:1E:9D:CD:21:8A:72:A3:DB:7C:B1:50:0F:83:D1:DC:E4:AD:25:90:8F:98:37:0F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cdn.tailwindcss.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://142cee.ralind.at/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\ndate: Wed, 19 Aug 2026 22:24:11 GMT\r\ncache-control: max-age=14400\r\nlocation: /3.4.17\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::fjjfq-1787177445711-0a0afbb714a1\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 806\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ce0JDIdHQQg9rGIn%2BbHm6WXEA1sylUqahdWco8ZSt2iGCDThsjiwVN8QjUvVxcC6JW7ox1ryP9gIFNzvEmdQ58RgE%2FVEEMKl1jrA%2BbmNur07O9MytksIwCvmej%2BOt%2FejEjA%2FvOw%3D\"}]}\r\ncf-ray: a2dc912a58f6e4e2-RIX\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T02:30:40.451427Z","times_seen":17982764,"resource_available":true,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":4,"connect":18,"send":0,"wait":22,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/pform.js","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:11.851Z","timestamp":1787178251851,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ralind.at","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 09:54:21 GMT","end":"Tue, 06 Oct 2026 09:54:20 GMT"},"fingerprint":{"sha1":"A0:B5:3F:5D:A6:FB:DD:64:0F:DF:90:18:78:FF:24:0A:7E:4D:A3:FE","sha256":"14:AA:A6:EE:B5:A7:60:65:06:58:72:44:8F:B2:16:25:B1:8E:79:16:6A:51:02:F3:E3:B8:D0:E4:5A:40:FB:0B"}}},"request":{"raw":"GET /referal/pform.js HTTP/1.1\r\nHost: 142cee.ralind.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://142cee.ralind.at/referal/zipo1hs.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Wed, 19 Aug 2026 22:24:11 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":278,"size_decoded":432,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"9ad2761e7c1cc85dc5f399b6c133c75c","sha1":"68379c26084a754576d6f7fa7b0a6dc25bb38370","sha256":"3c408e6a48350b23d3e327ce286c141f9c339c17551217fc1914b4eb83af5411","sha512":"f36d25f1a7bd8f48f656de829052876efc552e516b879912a73b2280cbf0d9ae312a19f1bebe32d98a8288d62423081f11b8d96d56d2539055fac2a9a8ec099a","ssdeep":"","tlshash":"55d02b9e5083b387481215b039c625c6278c13faa43a45e86d86d48752a857eceda5dc","first_seen":"2026-08-19T00:55:14.987928Z","last_seen":"2026-08-19T22:24:55.487843Z","times_seen":2,"resource_available":false,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":0,"connect":31,"send":0,"wait":55,"receive":0,"ssl":61},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-19","alert":"Phishing Block","trigger":"142cee.ralind.at","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/js/placeholder.js","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:11.857Z","timestamp":1787178251857,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ralind.at","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 09:54:21 GMT","end":"Tue, 06 Oct 2026 09:54:20 GMT"},"fingerprint":{"sha1":"A0:B5:3F:5D:A6:FB:DD:64:0F:DF:90:18:78:FF:24:0A:7E:4D:A3:FE","sha256":"14:AA:A6:EE:B5:A7:60:65:06:58:72:44:8F:B2:16:25:B1:8E:79:16:6A:51:02:F3:E3:B8:D0:E4:5A:40:FB:0B"}}},"request":{"raw":"GET /referal/js/placeholder.js HTTP/1.1\r\nHost: 142cee.ralind.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://142cee.ralind.at/referal/zipo1hs.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 19 Aug 2026 22:24:11 GMT\r\nContent-Type: application/javascript; charset=UTF-8\r\nLast-Modified: Thu, 23 Apr 2026 01:49:22 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"69e97aa2-179\"\r\nExpires: Thu, 20 Aug 2026 22:24:11 GMT\r\nCache-Control: max-age=86400\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":377,"size_decoded":597,"mime_type":"application/javascript; charset=UTF-8","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"4d8663f580217a26ef129cb80489078d","sha1":"d52b1a89d0a8ddfec448a5e74ff1d4c00335724c","sha256":"6caedafd637772a8543db1eebb0a2d5bf8b764ce4926aaa75ae9be9cb5ca55fc","sha512":"00c301a6e4169f0e8cf0320efdc93397107d18ef983582c262c7662aa7312963d6e115acbfe5d8e8c70c490b18fdfaeacaf6bbec100934d0900a90c7856ee9b9","ssdeep":"","tlshash":"0ae020291325c11506b2c77272b05e48b579856f5a418087373d451cfff19cfe456de1","first_seen":"2025-09-20T04:38:13.879676Z","last_seen":"2026-08-19T22:24:55.489503Z","times_seen":45,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":34,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-19","alert":"Phishing Block","trigger":"142cee.ralind.at","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/img/tutorial-step-two-dark-lg-a.png","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:11.868Z","timestamp":1787178251868,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ralind.at","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 09:54:21 GMT","end":"Tue, 06 Oct 2026 09:54:20 GMT"},"fingerprint":{"sha1":"A0:B5:3F:5D:A6:FB:DD:64:0F:DF:90:18:78:FF:24:0A:7E:4D:A3:FE","sha256":"14:AA:A6:EE:B5:A7:60:65:06:58:72:44:8F:B2:16:25:B1:8E:79:16:6A:51:02:F3:E3:B8:D0:E4:5A:40:FB:0B"}}},"request":{"raw":"GET /referal/img/tutorial-step-two-dark-lg-a.png HTTP/1.1\r\nHost: 142cee.ralind.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://142cee.ralind.at/referal/zipo1hs.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 19 Aug 2026 22:24:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 8500\r\nLast-Modified: Thu, 23 Apr 2026 01:49:22 GMT\r\nConnection: keep-alive\r\nETag: \"69e97aa2-2134\"\r\nExpires: Thu, 20 Aug 2026 22:24:12 GMT\r\nCache-Control: max-age=86400\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8500,"size_decoded":8803,"mime_type":"image/png","magic":"PNG image data, 360 x 192, 8-bit/color RGBA, non-interlaced","md5":"a3cf069a1c7a49a83620f7b1da7ca30e","sha1":"8fb8fe6b5bbddd3d67cb061df5aaa18cec0f6264","sha256":"f5ab2027104ec7c2c0cf405377f278aad38a9ef429c87ef2c168716e5e422c74","sha512":"212ad201df67afb76614a79c54dc78bc92756795fb2b9b500e4f1328a1747f7ad8fdc3ba35077e6e39300a70bcca3cc0022bf2eb795280e4ef928882cf4d05db","ssdeep":"192:bSmBbkVYRck7KauYh6QVwLnQukZOsYBXrB4:ODYV7KBE6QVl8sSru","tlshash":"49028d578a12cc0f2f2e1fdc9f4043d206b619024367cbb3ecc55c96a67e6b075a89ad","first_seen":"2025-09-20T04:38:14.12169Z","last_seen":"2026-08-19T22:24:55.490189Z","times_seen":6,"resource_available":false,"data":null}},"time_used":264,"timings":{"blocked":123,"dns":0,"connect":35,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-19","alert":"Phishing Block","trigger":"142cee.ralind.at","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/3.4.17","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.2.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:11.923Z","timestamp":1787178251923,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tailwindcss.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 17 Jul 2026 20:38:38 GMT","end":"Thu, 15 Oct 2026 21:38:35 GMT"},"fingerprint":{"sha1":"AF:4F:AD:59:FA:ED:77:04:0D:32:56:48:B0:E5:1B:38:67:6D:7D:02","sha256":"E7:FC:CF:2D:6A:CC:F5:3C:4C:1E:9D:CD:21:8A:72:A3:DB:7C:B1:50:0F:83:D1:DC:E4:AD:25:90:8F:98:37:0F"}}},"request":{"raw":"GET /3.4.17 HTTP/1.1\r\nHost: cdn.tailwindcss.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://142cee.ralind.at/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 19 Aug 2026 22:24:11 GMT\r\ncontent-type: text/javascript\r\ncache-control: max-age=31536000\r\ncontent-encoding: br\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::bj55r-1781146628084-40ce7f37f405\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nage: 6031623\r\nlast-modified: Tue, 30 Jun 2026 18:16:57 GMT\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mg9K6uv8BRf5w8XD%2B3irAelvN35K%2FaDr3celbvdki5NKPH5OXz3pp9D0sNSOj%2BozKB976%2F2P%2F3HC2VmU3UTey%2F27ZTa18Ie9PWiwUZxJHmVTnaAUTgBOxeQ8Akh3WYvVzIDabiY%3D\"}]}\r\ncf-ray: a2dc912a8922e4e2-RIX\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":407279,"size_decoded":127126,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (52853)","md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-08-20T02:24:58.562885Z","times_seen":49914,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:11.848Z","timestamp":1787178251848,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.5.0/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://142cee.ralind.at\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://142cee.ralind.at/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 19 Aug 2026 22:24:11 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 18859\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Tue, 28 Nov 2023 18:34:15 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=g%2B0z21LCIn1N1MsrAgyx26bCE9I1BQHjyxFUHZaAN8nyN1lbm4Y9PQa1Cnauc8XeJRlWGm9D7GfMtiDmRpFxfHeDVIzZc59s7pfh56gv%2FQEwk1ZMww7vZSE3XhAiaJ45ASOckGpK\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-ray: a2dc912a2b0356a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":102526,"size_decoded":19848,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (52276)","md5":"c43cd173eeeba2f72aa6b431d06b8c07","sha1":"427a692f7f39eabb3d5b8510aee2743025daf813","sha256":"c880eb3d25c765d399840aa204fec22b3230310991089f14781f09a35ed80b8a","sha512":"02f6f6422b83104bc1e1b64961d7edda63635528417ed2dd3c6f0527457b8ab4cb43c528d2a70fc61e0f96aec6e6d1a6d2b53ed523e1568b6d78ba41111c1393","ssdeep":"1536:vwMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPG9ZpgmLCq:P709gMGFiyPG9ZimLCq","tlshash":"4fa3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2024-01-04T18:36:36Z","last_seen":"2026-08-19T23:09:19.112232Z","times_seen":14794,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":3,"connect":10,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/pform.js","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:12.068Z","timestamp":1787178252068,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ralind.at","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 09:54:21 GMT","end":"Tue, 06 Oct 2026 09:54:20 GMT"},"fingerprint":{"sha1":"A0:B5:3F:5D:A6:FB:DD:64:0F:DF:90:18:78:FF:24:0A:7E:4D:A3:FE","sha256":"14:AA:A6:EE:B5:A7:60:65:06:58:72:44:8F:B2:16:25:B1:8E:79:16:6A:51:02:F3:E3:B8:D0:E4:5A:40:FB:0B"}}},"request":{"raw":"GET /referal/pform.js HTTP/1.1\r\nHost: 142cee.ralind.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://142cee.ralind.at/referal/zipo1hs.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Wed, 19 Aug 2026 22:24:12 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":278,"size_decoded":432,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"9ad2761e7c1cc85dc5f399b6c133c75c","sha1":"68379c26084a754576d6f7fa7b0a6dc25bb38370","sha256":"3c408e6a48350b23d3e327ce286c141f9c339c17551217fc1914b4eb83af5411","sha512":"f36d25f1a7bd8f48f656de829052876efc552e516b879912a73b2280cbf0d9ae312a19f1bebe32d98a8288d62423081f11b8d96d56d2539055fac2a9a8ec099a","ssdeep":"","tlshash":"55d02b9e5083b387481215b039c625c6278c13faa43a45e86d86d48752a857eceda5dc","first_seen":"2026-08-19T00:55:14.987928Z","last_seen":"2026-08-19T22:24:55.487843Z","times_seen":2,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-19","alert":"Phishing Block","trigger":"142cee.ralind.at","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/webfonts/fa-solid-900.woff2","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:12.314Z","timestamp":1787178252314,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.5.0/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://142cee.ralind.at\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 19 Aug 2026 22:24:12 GMT\r\ncontent-type: application/octet-stream; charset=utf-8\r\ncontent-length: 156532\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\nlast-modified: Tue, 28 Nov 2023 18:34:15 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Khn5n1rjJP8y7HY%2F2vcW2LUtDOX29MAb%2Fj%2FnUmHiGrdRrAaRlOKEuOry36f0aqx2r0W1WVCCsDkFCK3M7lldKxcogqfDzv7q9p5bqobW2FRWYFo10EqP77lkhxSYk2b2Kkr2Y1Qv\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=5,i=?0\r\nserver: cloudflare\r\ncf-ray: a2dc912cfcfe56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":156532,"size_decoded":157518,"mime_type":"application/octet-stream; charset=utf-8","magic":"Web Open Font Format (Version 2), TrueType, length 156532, version 773.256","md5":"d465bccb9edf0873f021f66d4b09d89c","sha1":"214f3c71de28c682602aecd39e9ad2bba15f1b0c","sha256":"f4c5a5b297e623bc159679563a4d1eb16e409ca3b57698fbc00fd2c907dadae0","sha512":"35d7523f48386e89b1cad6a47df65d64415ab9c45e6425bb4ab25ac9510f6d2e9de3d7cad79c2491660e885d7a38d3ffa9e93eb50ae045fbd072deaf114e10b8","ssdeep":"1536:HrPC5zUBeCGcReONEpKZZbwEPvdThY0E2eXOtr9pVhw+J3E6gbzlPAzJ+Zn+PMY6:TC5oNnZbwC9Wie+B9pVSeE6dMZnaBi","tlshash":"00e313b58f11a1c781b12217db1a54f8da785eec5e3f968cc5a07786214dd4f93dcca0","first_seen":"2024-01-04T18:36:36Z","last_seen":"2026-08-19T23:09:19.118042Z","times_seen":10518,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/webfonts/fa-regular-400.woff2","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:12.316Z","timestamp":1787178252316,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.5.0/webfonts/fa-regular-400.woff2 HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://142cee.ralind.at\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 19 Aug 2026 22:24:12 GMT\r\ncontent-type: application/octet-stream; charset=utf-8\r\ncontent-length: 25480\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\nlast-modified: Tue, 28 Nov 2023 18:34:15 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=t9sZow9DSmRZLV2fYLs1XKE%2BEHpl%2FYa4XN1kB7Qllm977CCo4NP%2BlHGp%2FHzKz7NxHRpSk8%2FlKxRLW2Db%2FvjUrElkf7fsBdT8rxmA%2BfhYp5VX3aXKjUu%2FDsMERXTkJC14gz%2BiqZIZ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=5,i=?0\r\nserver: cloudflare\r\ncf-ray: a2dc912cfcff56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25480,"size_decoded":26477,"mime_type":"application/octet-stream; charset=utf-8","magic":"Web Open Font Format (Version 2), TrueType, length 25480, version 773.256","md5":"c002718472e4de08b9d135298ad67aad","sha1":"d3b1723cc7cf1855aacd2d6b8d17ddb2a0fac922","sha256":"3a74c08d486310c03731b458616f0172375fe3780e96165f8a1adc02d1355eaa","sha512":"2a86740aa47c564b19a37ad5b642e33128b12c45bf4bf81de8ce3e7f5524615fb3b017ac280c689311cd8ca3222afd50634ecca3db732083b696d65a34204544","ssdeep":"384:g9freFKNs96snevGfjMOQMjqYxNVjFr2x+gnq1wG6MWnPL2HPIPSg7OaX:g9je+snl7/xFrDgq/ppQPke","tlshash":"b5b2d0e16ec2243ec4c7e7bc95cf693e92c2f9c70b01aefe05ed8d2296932109274516","first_seen":"2024-07-17T22:32:06Z","last_seen":"2026-08-19T22:24:55.492818Z","times_seen":1550,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/favicon.ico","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://142cee.ralind.at/referal/zipo1hs.php","date":"2026-08-19T22:24:12.482Z","timestamp":1787178252482,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ralind.at","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 09:54:21 GMT","end":"Tue, 06 Oct 2026 09:54:20 GMT"},"fingerprint":{"sha1":"A0:B5:3F:5D:A6:FB:DD:64:0F:DF:90:18:78:FF:24:0A:7E:4D:A3:FE","sha256":"14:AA:A6:EE:B5:A7:60:65:06:58:72:44:8F:B2:16:25:B1:8E:79:16:6A:51:02:F3:E3:B8:D0:E4:5A:40:FB:0B"}}},"request":{"raw":"GET /referal/favicon.ico HTTP/1.1\r\nHost: 142cee.ralind.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://142cee.ralind.at/referal/zipo1hs.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 19 Aug 2026 22:24:12 GMT\r\nContent-Type: image/vnd.microsoft.icon\r\nContent-Length: 9662\r\nConnection: keep-alive\r\nLast-Modified: Thu, 23 Apr 2026 01:49:22 GMT\r\nETag: \"25be-65016db7c93af\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9662,"size_decoded":9915,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel","md5":"e5f2babeeb408baa5a9bb8206258fae6","sha1":"c11f5f81325fa77797dbfed8933794c011318192","sha256":"3cf57680ce7a3087bd69ba2548e9c641ae555ce97427f06be87d5fb5a36033a8","sha512":"c42737c26d79aa2d3d7c5160de77de93a535c8e289c50beb5bfa618d6a80237be2a32b2b51943764fda0cb53248e85e62da236b8a476925da838083c7b3913af","ssdeep":"96:9OwnQ219jcsvZ8CBISa8pudyKzbXBi5ZQlsXkh:Hv8kJasozbBuQ9","tlshash":"a312a9c1a1a232d1ed314df318692cd4c1392ca81ad4f8bd9fc2b117b53b2a63fa5127","first_seen":"2024-02-19T00:52:24Z","last_seen":"2026-08-19T22:24:55.494632Z","times_seen":374,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-19","alert":"Phishing Block","trigger":"142cee.ralind.at","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"142cee.ralind.at/referal/zipo1hs.php","fqdn":"142cee.ralind.at","domain":"ralind.at","tld":"at"},"ip":{"addr":"31.59.121.53","port":443,"asn":834,"as":"IPXO","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-19T22:24:11.181Z","timestamp":1787178251181,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ralind.at","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 09:54:21 GMT","end":"Tue, 06 Oct 2026 09:54:20 GMT"},"fingerprint":{"sha1":"A0:B5:3F:5D:A6:FB:DD:64:0F:DF:90:18:78:FF:24:0A:7E:4D:A3:FE","sha256":"14:AA:A6:EE:B5:A7:60:65:06:58:72:44:8F:B2:16:25:B1:8E:79:16:6A:51:02:F3:E3:B8:D0:E4:5A:40:FB:0B"}}},"request":{"raw":"GET /referal/zipo1hs.php HTTP/1.1\r\nHost: 142cee.ralind.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 19 Aug 2026 22:24:11 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 8423\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Contentful","description":"Contentful is an API-first content management platform to create, manage and publish content on any digital channel.","website":"https://www.contentful.com","common_platform_enumeration":"","icon":"Contentful.svg","categories":["CMS"]},{"name":"Tailwind CSS","description":"Tailwind is a utility-first CSS framework.","website":"https://tailwindcss.com/","common_platform_enumeration":"","icon":"tailwindcss.svg","categories":["UI frameworks"]}],"data":{"size":31775,"size_decoded":8627,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2681), with CRLF line terminators","md5":"40af0418887e65bc55551401d9eb2e37","sha1":"a86007cd49063f330f67c1862cd5ba4c7c4e1b13","sha256":"32c56115a7af4a3bcdff02df10dd5e52984273b718f6f173f5196729805f14e2","sha512":"6c60ea8eb46bd82e8a7234ae82e44935e6439135d55fdcbb93ab907c8f7e9086a0cff0e51564ecb42756a09d404e0a6316eae9c92aa3e0b8f76d856428338b2b","ssdeep":"384:2ag+nZNQ3El3KJ/SVLiePUfJfXKdESTU5GukZ5QTEr0J:2ag+g383KpKYfRVJ5Gue70J","tlshash":"69e2e6286191153a417386ba77a5170efbb49107e603c3167aec02572ff7ea148e3bdc","first_seen":"2026-08-19T00:55:14.983337Z","last_seen":"2026-08-19T22:24:55.495424Z","times_seen":2,"resource_available":false,"data":null}},"time_used":428,"timings":{"blocked":-1,"dns":226,"connect":36,"send":0,"wait":55,"receive":0,"ssl":110},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-19","alert":"Phishing Block","trigger":"142cee.ralind.at","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-19","alert":"Sinkholed","trigger":"142cee.ralind.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}