{"report_id":"2c2cc40c-d962-4975-b090-5c4e3550fbcb","version":0,"status":"done","tags":[],"date":"2026-09-29T06:05:20Z","url":{"schema":"http","addr":"sitemuls00qrsh0k.xyz/","fqdn":"sitemuls00qrsh0k.xyz","domain":"sitemuls00qrsh0k.xyz","tld":"xyz"},"ip":{"addr":"172.67.179.205","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"sitemuls00qrsh0k.xyz/","fqdn":"sitemuls00qrsh0k.xyz","domain":"sitemuls00qrsh0k.xyz","tld":"xyz"},"title":"Hylo rewards","dom":{"size":31161,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (2316)","md5":"14fd67df3f7ffa639cc324697c89bb1a","sha1":"a8a96b5900b02d5211a77aa8f2d42c30e7054013","sha256":"ebac171a4bd163d37414d04d546af7222e115d5bfd0d8322541dcb90c8683701","sha512":"86a98f3872d9efabf4a1fe1fd005af782d46baa94da8cf201a7516dba7a6324ba532cd5c1ce2eee9a9a8da499d603760f49ab5d9303f80cb233c0dbece3ee923","ssdeep":"768:nhUdG8soy/L93JBjF3FkjC4iKbPnPNjMEAgfyV57UdGPfTPBFPL:MsJ/3iW+dqsCfDBFL","tlshash":"21e219e163d301bd7947d3d4ba6ba3263272e84bcd40c965b7cc05889f8d8dc99e3688","dom_hash":"domhash2cd1c406ccd50953cda6ab09216bec5a","first_seen":"2026-09-29T06:05:21.357331Z","last_seen":"2026-09-29T06:05:21.357331Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"sitemuls00qrsh0k.xyz/","fqdn":"sitemuls00qrsh0k.xyz","domain":"sitemuls00qrsh0k.xyz","tld":"xyz"},"ip":{"addr":"172.67.179.205","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-03T06:05:20Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"sitemuls00qrsh0k.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-09-27T22:45:36.707646Z","alert_count":0,"request_count":4,"received_data":120464,"sent_data":2244,"comment":"","tags":null,"fingerprints":null},{"fqdn":"sitemuls00qrsh0k.xyz","ip":{"addr":"172.67.179.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-09-28","domain_rank":0,"first_seen":"2026-09-29T05:57:49.108532Z","last_seen":"2026-09-29T05:57:51.043376Z","alert_count":5,"request_count":5,"received_data":172112,"sent_data":2441,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-27T22:44:07.016679Z","alert_count":0,"request_count":1,"received_data":17253,"sent_data":556,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"sitemuls00qrsh0k.xyz/loader.js","fqdn":"sitemuls00qrsh0k.xyz","domain":"sitemuls00qrsh0k.xyz","tld":"xyz"},"ip":{"addr":"172.67.179.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a9a28ca1f07447faa43387a6e5ff91d1","sha1":"c8fb53c76fd993fe54672c25f93a1a046ac85d05","sha256":"d9aed3f72a602d44fd1a8e388668a96e652a68047183fc3eac45e9bcfd74732e","sha512":"8d378f1f7d86aff895f374e91d7b7deeb1e2bee6fee9c96864eff2c512708bc9178d0d5b11e4c97b617150dcecee1ebb5cd1b84f349d6e3dc3e9828c81392823","ssdeep":"768:HbMFcD//9nZD8RUGKOsALd89/oltAq+2Bkz+wpB:cC9oUGKiLEolt/DF4","tlshash":"0203a48eaae621324263717d0bbf11557132d4035548c9287eaca3102fe477ea6f7fe9","size":40668,"data":"","first_seen":"2026-09-27T02:52:20.483507Z","last_seen":"2026-09-29T06:05:21.367507Z","times_seen":32,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sitemuls00qrsh0k.xyz/","fqdn":"sitemuls00qrsh0k.xyz","domain":"sitemuls00qrsh0k.xyz","tld":"xyz"},"ip":{"addr":"172.67.179.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f5b767c078c6813816231552aca1d562","sha1":"34f99579b527c24b3a5af82abb42079a0d3e1a51","sha256":"c17d50bae5a02a35e0ae5d0005c694495952f093629bb5193c668070161b0f7a","sha512":"7b4aed1d33c4891894a556505047a8f7afd72efc1c30c064b5a428fac50a5475e895f3937869de6d047128910d762069084c41d12fbacecffd43cd98e84b2e48","ssdeep":"","tlshash":"70c0125d7010696614ce687d4ccf088ebe368812a20809c999dcd4547bb1e6c42e484c","size":185,"data":"","first_seen":"2024-04-08T19:47:46Z","last_seen":"2026-09-29T06:05:21.370476Z","times_seen":749,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sitemuls00qrsh0k.xyz/","fqdn":"sitemuls00qrsh0k.xyz","domain":"sitemuls00qrsh0k.xyz","tld":"xyz"},"ip":{"addr":"172.67.179.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"2b8b7861dfe34bd6d57f727f181d5c2e","sha1":"cdbb143e56c84dab1b06ba8352b8a20333e45ff4","sha256":"d0101948639fac02b15032049670611ed82c315745529161a2a359bd9b40fe55","sha512":"acb5a4b8c94ea2bd40a2d2aa8b184460c40598f8328cb582427886a2e7916a0071d392b655d84f0153ae05922bbcca298cc892caed924e2a16ee54ae83004d4a","ssdeep":"","tlshash":"6f115caff5653e7588fb7ab6118fb29836331102444589052bac8ad70f28d95a8e7cc5","size":1020,"data":"","first_seen":"2026-07-22T10:16:13.778766Z","last_seen":"2026-09-29T06:05:21.371293Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fonts.gstatic.com/s/geist/v5/gyByhwUxId8gMEwcGFWNPoTcZY4.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sitemuls00qrsh0k.xyz/","date":"2026-09-29T06:04:51.463Z","timestamp":1790661891463,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Thu, 10 Sep 2026 19:23:28 GMT","end":"Thu, 03 Dec 2026 19:23:27 GMT"},"fingerprint":{"sha1":"99:42:CC:AA:D1:36:35:7D:FF:39:32:44:00:41:07:B9:D3:00:EE:31","sha256":"48:CD:EE:73:11:77:6B:F0:EE:10:C6:1D:DF:58:7C:4B:88:0D:95:F3:9C:64:15:44:E2:93:5B:17:4F:6A:8E:6E"}}},"request":{"raw":"GET /s/geist/v5/gyByhwUxId8gMEwcGFWNPoTcZY4.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://sitemuls00qrsh0k.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 29304\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 28 Sep 2026 16:06:13 GMT\r\nexpires: Tue, 28 Sep 2027 16:06:13 GMT\r\ncache-control: public, max-age=31536000\r\nage: 50318\r\nlast-modified: Wed, 13 May 2026 17:53:51 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":29304,"size_decoded":30116,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 29304, version 1.0","md5":"981055687324f3dedfb5a24339f2eede","sha1":"73487b35c1a834e402828d3f3421821630cfa5ca","sha256":"49f46fee70346a0520f20763e5a41807ddfc33268d7010657affe031179aa0b4","sha512":"85f5381398698481b504686b2b9b525de81afceb6c0a068a689a41f0cc752c6b444773711059f72e61c739027aac1666262bb0b6288b4c90e632dc4bc34e7ee3","ssdeep":"768:ooecEnSFJJZ4/IeT4Iih8/mnmfgljb2dePdhiLMGF9YKA5Y:oaEnSFJH9/hingl+dzMq91iY","tlshash":"48d2f1d5da2131ffd84ab7b458cad6913525256085bbc706ccb0cbc1890beeaf60d1ee","first_seen":"2026-05-14T01:29:15.492288Z","last_seen":"2026-09-29T06:13:37.809516Z","times_seen":6577,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":35,"dns":0,"connect":0,"send":0,"wait":54,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sitemuls00qrsh0k.xyz/e997b0a1a177f76e.css","fqdn":"sitemuls00qrsh0k.xyz","domain":"sitemuls00qrsh0k.xyz","tld":"xyz"},"ip":{"addr":"172.67.179.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sitemuls00qrsh0k.xyz/","date":"2026-09-29T06:04:51.323Z","timestamp":1790661891323,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sitemuls00qrsh0k.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 28 Sep 2026 21:22:06 GMT","end":"Sun, 27 Dec 2026 21:22:05 GMT"},"fingerprint":{"sha1":"90:30:EA:F1:7F:AB:F5:AB:BB:43:51:9A:F2:63:DB:BE:1C:5E:27:32","sha256":"96:8D:E4:4C:B3:82:0D:50:C6:2D:C8:89:8F:05:79:55:DE:C1:7E:0F:63:D5:A7:19:33:24:D6:24:EA:CB:3A:FB"}}},"request":{"raw":"GET /e997b0a1a177f76e.css HTTP/1.1\r\nHost: sitemuls00qrsh0k.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sitemuls00qrsh0k.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 29 Sep 2026 06:04:51 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 10 May 2026 18:29:38 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=benO9aSsWjmlfpk6BmlKMbbCI77rLmcl9zOqtgpHGz3yBL8bREhYeeXbJ0V92sjsgVRpMZwiCZt6kSLKe7o47S5biawST6z3BWs49QdAAlyrW1RXC%2F%2BrDfqMc4V9uy4jvWt4G%2FxNzw%3D%3D\"}]}\r\npriority: u=2,i=?0\r\netag: W/\"6a00ce92-10909\"\r\ncontent-encoding: gzip\r\nage: 481\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a428caf4cee6569f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67849,"size_decoded":15905,"mime_type":"text/css","magic":"ASCII text, with very long lines (59157)","md5":"2030e41838ee588a81f97e3514e595f9","sha1":"b22952de1ef61a83f7f80169ec2c61c7510ce60e","sha256":"a185076d5bedeae5b6d1ca47a5849bb67c6fe0b2de0447535db34c14a8dca12e","sha512":"6069e19e80a8e67b5f843bb4676e93ef6539cd161b75726ccce46454278714ab89eedbf3e9c8f291b3d8d69985d3a054a3ec9367731268dff918265e558c41ae","ssdeep":"768:trlxbekPI43Aw/vRZKhjsdNGR0ilnTs6u9vGl2mRVf0NjDoFPXouZo1Sa3XB:RbekPI431RZKhjsNvGEmTMFoFPXcSanB","tlshash":"d963b894a33ae93fec3754b6a35cb81da20d7586df212ad9f602212247c77f60e71724","first_seen":"2026-07-22T10:16:13.772626Z","last_seen":"2026-09-29T06:05:21.362508Z","times_seen":16,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"sitemuls00qrsh0k.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Geist:wght@100;200;300;400;500;600;700;800;900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sitemuls00qrsh0k.xyz/","date":"2026-09-29T06:04:51.326Z","timestamp":1790661891326,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Thu, 10 Sep 2026 19:23:29 GMT","end":"Thu, 03 Dec 2026 19:23:28 GMT"},"fingerprint":{"sha1":"6C:5B:26:B8:8E:09:56:23:73:54:AC:B4:B3:91:75:07:31:24:4F:2D","sha256":"83:FB:4A:3F:88:06:C6:06:CC:A5:92:12:C8:C2:89:BD:56:6A:F9:0D:8F:49:3D:A0:83:3B:7E:53:A1:2C:69:05"}}},"request":{"raw":"GET /css2?family=Geist:wght@100;200;300;400;500;600;700;800;900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sitemuls00qrsh0k.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 29 Sep 2026 06:04:51 GMT\r\ndate: Tue, 29 Sep 2026 06:04:51 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16569,"size_decoded":1462,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"1a7b4d2045eb6e097183eddc80f1da47","sha1":"46e76af4fd62f8d07fb18a29fd6a9fb9411fa2a5","sha256":"ef0d6a925a7469a14271332ea6f3128963333acf304bbc6938899f8f8ef2bb74","sha512":"b7cc9746c5b521e276702a2ea8d88c0e5bde42816922641d5f0493c55ba207be69f8276ec75c2ad722ce738ec33752272101256ec244bafdf517767a308c7ce3","ssdeep":"192:QptgpJjpdptSp9t5Jk2tL+tKJLVtkXtrJqotZwtEJZvtqptNJgStH6tOJHBtgTtW:QXgXjzexnMQC14+qzs8Shwau","tlshash":"90729d91046bd400eb931cc237ce7f72ae8e60116444d57ebbfd09edacaac26136976d","first_seen":"2026-05-14T02:05:57.357146Z","last_seen":"2026-09-29T06:05:21.363153Z","times_seen":79,"resource_available":true,"data":null}},"time_used":78,"timings":{"blocked":-1,"dns":0,"connect":14,"send":0,"wait":34,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sitemuls00qrsh0k.xyz/favicon.ico","fqdn":"sitemuls00qrsh0k.xyz","domain":"sitemuls00qrsh0k.xyz","tld":"xyz"},"ip":{"addr":"172.67.179.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sitemuls00qrsh0k.xyz/","date":"2026-09-29T06:04:51.436Z","timestamp":1790661891436,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sitemuls00qrsh0k.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 28 Sep 2026 21:22:06 GMT","end":"Sun, 27 Dec 2026 21:22:05 GMT"},"fingerprint":{"sha1":"90:30:EA:F1:7F:AB:F5:AB:BB:43:51:9A:F2:63:DB:BE:1C:5E:27:32","sha256":"96:8D:E4:4C:B3:82:0D:50:C6:2D:C8:89:8F:05:79:55:DE:C1:7E:0F:63:D5:A7:19:33:24:D6:24:EA:CB:3A:FB"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: sitemuls00qrsh0k.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sitemuls00qrsh0k.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 29 Sep 2026 06:04:51 GMT\r\ncontent-type: image/x-icon\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oULPQ2dbaM8%2BTxdu0T%2FzdetsoupV6MWK8Mu5YNWXAQtnVkrRHAowYmSpPq4P4xy9Lt%2B7U3wiBzhpV80lsC1ZEG06UW5Rp1LFWuGGmYBEbiFveHL4rA5g4KV3%2FIXFkHdoa4HqD8ZFUQ%3D%3D\"}]}\r\nlast-modified: Sun, 10 May 2026 18:29:38 GMT\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"6a00ce92-654b\"\r\nage: 480\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a428caf57eff569f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25931,"size_decoded":10042,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"c30c7d42707a47a3f4591831641e50dc","sha1":"9ecfcc8f0ead0bf3d2d7c39e084b88f41cc89a2e","sha256":"2b8ad2d33455a8f736fc3a8ebf8f0bdea8848ad4c0db48a2833bd0f9cd775932","sha512":"7053e0f76e92179fb5154e2665d81897736bdcc22b002b0a3f8e212f27ef80f56224adaa09972848a20c66b064d16eafa732140461071ad70b6193c33dd517e0","ssdeep":"384:ryveIpvjGAUdJ/RN0d2q3OTirIDpXofYPj68Xg5RNy7yyTLb4v0:bIAJdhwYqZ8pYYPjSy7j3j","tlshash":"11c28e9b2b7e2015c908257641aeddfb011b5d4b28b4a20025fa3eb7b4b3735091fa7f","first_seen":"2023-04-30T22:57:19Z","last_seen":"2026-09-29T07:49:54.505933Z","times_seen":47133,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"sitemuls00qrsh0k.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sitemuls00qrsh0k.xyz/icon.svg","fqdn":"sitemuls00qrsh0k.xyz","domain":"sitemuls00qrsh0k.xyz","tld":"xyz"},"ip":{"addr":"172.67.179.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sitemuls00qrsh0k.xyz/","date":"2026-09-29T06:04:51.437Z","timestamp":1790661891437,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sitemuls00qrsh0k.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 28 Sep 2026 21:22:06 GMT","end":"Sun, 27 Dec 2026 21:22:05 GMT"},"fingerprint":{"sha1":"90:30:EA:F1:7F:AB:F5:AB:BB:43:51:9A:F2:63:DB:BE:1C:5E:27:32","sha256":"96:8D:E4:4C:B3:82:0D:50:C6:2D:C8:89:8F:05:79:55:DE:C1:7E:0F:63:D5:A7:19:33:24:D6:24:EA:CB:3A:FB"}}},"request":{"raw":"GET /icon.svg HTTP/1.1\r\nHost: sitemuls00qrsh0k.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sitemuls00qrsh0k.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 29 Sep 2026 06:04:51 GMT\r\ncontent-type: image/svg+xml\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Se8nzHgXImcFUwQJPv%2FV2r2CHaja1nVZ6EjhrFQV1khIkulmy07DRchvHxH9EEyku6Vb2%2F%2BN1UHC52aihC3zYWD2OkDC6l5qYtFbDgQdvSVT44Uleir4TvkjVxYfuSSgVA9G1vrrEA%3D%3D\"}]}\r\nlast-modified: Sun, 10 May 2026 18:29:38 GMT\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"6a00ce92-b79\"\r\nage: 480\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a428caf58f00569f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2937,"size_decoded":1883,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fef2c75abefe7d20a5638a4184800437","sha1":"e66d232426289c476992e6c23f37722fd870288f","sha256":"52e44692eafc95642264e20eab5fbe0cead48c5f3b44cfa91087cc667deed6c5","sha512":"ade975a162e58158a0465dab50787795a169eab5fc9df125abf548d0c810352aa9e13c23bb8127f1c405b9c2bc8e8c182b125519ce7893415f84da701ed2c70d","ssdeep":"","tlshash":"185130ddfbf60dd8c0d896d26f73915c2c17a2b691988f3cc14cc61926c5aac193678b","first_seen":"2026-07-22T10:16:13.769511Z","last_seen":"2026-09-29T06:05:21.364892Z","times_seen":16,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"sitemuls00qrsh0k.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/geist/v5/gyByhwUxId8gMEwcGFWNPoTcZY4.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sitemuls00qrsh0k.xyz/","date":"2026-09-29T06:04:51.456Z","timestamp":1790661891456,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Thu, 10 Sep 2026 19:23:28 GMT","end":"Thu, 03 Dec 2026 19:23:27 GMT"},"fingerprint":{"sha1":"99:42:CC:AA:D1:36:35:7D:FF:39:32:44:00:41:07:B9:D3:00:EE:31","sha256":"48:CD:EE:73:11:77:6B:F0:EE:10:C6:1D:DF:58:7C:4B:88:0D:95:F3:9C:64:15:44:E2:93:5B:17:4F:6A:8E:6E"}}},"request":{"raw":"GET /s/geist/v5/gyByhwUxId8gMEwcGFWNPoTcZY4.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://sitemuls00qrsh0k.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 29304\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 28 Sep 2026 16:06:13 GMT\r\nexpires: Tue, 28 Sep 2027 16:06:13 GMT\r\ncache-control: public, max-age=31536000\r\nage: 50318\r\nlast-modified: Wed, 13 May 2026 17:53:51 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":29304,"size_decoded":30116,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 29304, version 1.0","md5":"981055687324f3dedfb5a24339f2eede","sha1":"73487b35c1a834e402828d3f3421821630cfa5ca","sha256":"49f46fee70346a0520f20763e5a41807ddfc33268d7010657affe031179aa0b4","sha512":"85f5381398698481b504686b2b9b525de81afceb6c0a068a689a41f0cc752c6b444773711059f72e61c739027aac1666262bb0b6288b4c90e632dc4bc34e7ee3","ssdeep":"768:ooecEnSFJJZ4/IeT4Iih8/mnmfgljb2dePdhiLMGF9YKA5Y:oaEnSFJH9/hingl+dzMq91iY","tlshash":"48d2f1d5da2131ffd84ab7b458cad6913525256085bbc706ccb0cbc1890beeaf60d1ee","first_seen":"2026-05-14T01:29:15.492288Z","last_seen":"2026-09-29T06:13:37.809516Z","times_seen":6577,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":0,"connect":42,"send":0,"wait":31,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/geist/v5/gyByhwUxId8gMEwcGFWNPoTcZY4.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sitemuls00qrsh0k.xyz/","date":"2026-09-29T06:04:51.457Z","timestamp":1790661891457,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Thu, 10 Sep 2026 19:23:28 GMT","end":"Thu, 03 Dec 2026 19:23:27 GMT"},"fingerprint":{"sha1":"99:42:CC:AA:D1:36:35:7D:FF:39:32:44:00:41:07:B9:D3:00:EE:31","sha256":"48:CD:EE:73:11:77:6B:F0:EE:10:C6:1D:DF:58:7C:4B:88:0D:95:F3:9C:64:15:44:E2:93:5B:17:4F:6A:8E:6E"}}},"request":{"raw":"GET /s/geist/v5/gyByhwUxId8gMEwcGFWNPoTcZY4.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://sitemuls00qrsh0k.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 29304\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 28 Sep 2026 16:06:13 GMT\r\nexpires: Tue, 28 Sep 2027 16:06:13 GMT\r\ncache-control: public, max-age=31536000\r\nage: 50318\r\nlast-modified: Wed, 13 May 2026 17:53:51 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":29304,"size_decoded":30116,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 29304, version 1.0","md5":"981055687324f3dedfb5a24339f2eede","sha1":"73487b35c1a834e402828d3f3421821630cfa5ca","sha256":"49f46fee70346a0520f20763e5a41807ddfc33268d7010657affe031179aa0b4","sha512":"85f5381398698481b504686b2b9b525de81afceb6c0a068a689a41f0cc752c6b444773711059f72e61c739027aac1666262bb0b6288b4c90e632dc4bc34e7ee3","ssdeep":"768:ooecEnSFJJZ4/IeT4Iih8/mnmfgljb2dePdhiLMGF9YKA5Y:oaEnSFJH9/hingl+dzMq91iY","tlshash":"48d2f1d5da2131ffd84ab7b458cad6913525256085bbc706ccb0cbc1890beeaf60d1ee","first_seen":"2026-05-14T01:29:15.492288Z","last_seen":"2026-09-29T06:13:37.809516Z","times_seen":6577,"resource_available":false,"data":null}},"time_used":116,"timings":{"blocked":35,"dns":0,"connect":0,"send":0,"wait":33,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sitemuls00qrsh0k.xyz/","fqdn":"sitemuls00qrsh0k.xyz","domain":"sitemuls00qrsh0k.xyz","tld":"xyz"},"ip":{"addr":"172.67.179.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-29T06:04:50.817Z","timestamp":1790661890817,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sitemuls00qrsh0k.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 28 Sep 2026 21:22:06 GMT","end":"Sun, 27 Dec 2026 21:22:05 GMT"},"fingerprint":{"sha1":"90:30:EA:F1:7F:AB:F5:AB:BB:43:51:9A:F2:63:DB:BE:1C:5E:27:32","sha256":"96:8D:E4:4C:B3:82:0D:50:C6:2D:C8:89:8F:05:79:55:DE:C1:7E:0F:63:D5:A7:19:33:24:D6:24:EA:CB:3A:FB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: sitemuls00qrsh0k.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 29 Sep 2026 06:04:50 GMT\r\ncontent-type: text/html\r\nlast-modified: Sat, 19 Sep 2026 23:08:55 GMT\r\nvary: accept-encoding\r\npriority: u=0,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZU9dxBYop%2FpCBE6gH8lPP5S8gefzqVsMaaBviALv6DwzU%2FOxcIC4Zz6dsSHNFtSfzXeqU95ttzkoMAs3x3%2FWqyqZScTF6IZuXq5uu10q1aAyrFA4XTdxkNpayBL7lbXFlshxzoWJOQ%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a428caf1cec2569f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31235,"size_decoded":10740,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2284)","md5":"348980cd74228261fe8cb046fe4ff4fb","sha1":"ddb963a25e89cc37ef4da64d919cb4915bd851f9","sha256":"7c049239062d18ca9bce32f5d45a49ff3697e7ae70666def7e69cca1497dc989","sha512":"571f86111f6ab91c980a429330569daf0a19bd22afd659bbeb25e4cdb9698afb0b4dd9d9359d70783e35f12400abcd42ed596037bd6479911dde2f7c2006e185","ssdeep":"768:yhUdG86oy/LRlx7FHFkjy4SKbPnPrjMEAURyC57UdGPfTPBFPy:n6J/DiG+pTsCfDBFy","tlshash":"e2e229e163d311bd7957d3d4ba6ba32a3262e84bcd00c965b7cc05849f8d8dc99e3788","first_seen":"2026-09-29T04:56:12.161933Z","last_seen":"2026-09-29T06:05:21.366323Z","times_seen":8,"resource_available":true,"data":null}},"time_used":154,"timings":{"blocked":0,"dns":5,"connect":19,"send":0,"wait":130,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"sitemuls00qrsh0k.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sitemuls00qrsh0k.xyz/loader.js","fqdn":"sitemuls00qrsh0k.xyz","domain":"sitemuls00qrsh0k.xyz","tld":"xyz"},"ip":{"addr":"172.67.179.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sitemuls00qrsh0k.xyz/","date":"2026-09-29T06:04:51.328Z","timestamp":1790661891328,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sitemuls00qrsh0k.xyz","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 28 Sep 2026 21:22:06 GMT","end":"Sun, 27 Dec 2026 21:22:05 GMT"},"fingerprint":{"sha1":"90:30:EA:F1:7F:AB:F5:AB:BB:43:51:9A:F2:63:DB:BE:1C:5E:27:32","sha256":"96:8D:E4:4C:B3:82:0D:50:C6:2D:C8:89:8F:05:79:55:DE:C1:7E:0F:63:D5:A7:19:33:24:D6:24:EA:CB:3A:FB"}}},"request":{"raw":"GET /loader.js HTTP/1.1\r\nHost: sitemuls00qrsh0k.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sitemuls00qrsh0k.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 29 Sep 2026 06:04:51 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 19 Sep 2026 23:04:11 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dFtJw9tUeiDlQhnCcfWSpJTqu7sC%2Bv3ki19YCzQAB%2F6g2tHGvSlu61Jrq%2FaM1zAkUTUGYnJHCZBLMpXqIE9qLORydihxLPO2reJceJByxbJTtHKM%2FmfubG%2FTKldGs9Dlogn8KuGAbg%3D%3D\"}]}\r\npriority: u=2,i=?0\r\netag: W/\"6aaf14eb-9ede\"\r\ncontent-encoding: gzip\r\nage: 481\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a428caf4cee7569f-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":40670,"size_decoded":13478,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"a9a28ca1f07447faa43387a6e5ff91d1","sha1":"c8fb53c76fd993fe54672c25f93a1a046ac85d05","sha256":"d9aed3f72a602d44fd1a8e388668a96e652a68047183fc3eac45e9bcfd74732e","sha512":"8d378f1f7d86aff895f374e91d7b7deeb1e2bee6fee9c96864eff2c512708bc9178d0d5b11e4c97b617150dcecee1ebb5cd1b84f349d6e3dc3e9828c81392823","ssdeep":"768:HbMFcD//9nZD8RUGKOsALd89/oltAq+2Bkz+wpB:cC9oUGKiLEolt/DF4","tlshash":"0203a48eaae621324263717d0bbf11557132d4035548c9287eaca3102fe477ea6f7fe9","first_seen":"2026-09-27T02:52:20.483507Z","last_seen":"2026-09-29T06:05:21.367507Z","times_seen":32,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-29","alert":"Sinkholed","trigger":"sitemuls00qrsh0k.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/geist/v5/gyByhwUxId8gMEwcGFWNPoTcZY4.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sitemuls00qrsh0k.xyz/","date":"2026-09-29T06:04:51.458Z","timestamp":1790661891458,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Thu, 10 Sep 2026 19:23:28 GMT","end":"Thu, 03 Dec 2026 19:23:27 GMT"},"fingerprint":{"sha1":"99:42:CC:AA:D1:36:35:7D:FF:39:32:44:00:41:07:B9:D3:00:EE:31","sha256":"48:CD:EE:73:11:77:6B:F0:EE:10:C6:1D:DF:58:7C:4B:88:0D:95:F3:9C:64:15:44:E2:93:5B:17:4F:6A:8E:6E"}}},"request":{"raw":"GET /s/geist/v5/gyByhwUxId8gMEwcGFWNPoTcZY4.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://sitemuls00qrsh0k.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 29304\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 28 Sep 2026 16:06:13 GMT\r\nexpires: Tue, 28 Sep 2027 16:06:13 GMT\r\ncache-control: public, max-age=31536000\r\nage: 50318\r\nlast-modified: Wed, 13 May 2026 17:53:51 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":29304,"size_decoded":30116,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 29304, version 1.0","md5":"981055687324f3dedfb5a24339f2eede","sha1":"73487b35c1a834e402828d3f3421821630cfa5ca","sha256":"49f46fee70346a0520f20763e5a41807ddfc33268d7010657affe031179aa0b4","sha512":"85f5381398698481b504686b2b9b525de81afceb6c0a068a689a41f0cc752c6b444773711059f72e61c739027aac1666262bb0b6288b4c90e632dc4bc34e7ee3","ssdeep":"768:ooecEnSFJJZ4/IeT4Iih8/mnmfgljb2dePdhiLMGF9YKA5Y:oaEnSFJH9/hingl+dzMq91iY","tlshash":"48d2f1d5da2131ffd84ab7b458cad6913525256085bbc706ccb0cbc1890beeaf60d1ee","first_seen":"2026-05-14T01:29:15.492288Z","last_seen":"2026-09-29T06:13:37.809516Z","times_seen":6577,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":35,"dns":0,"connect":0,"send":0,"wait":44,"receive":42,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}