{"report_id":"30e6a5e2-d6f1-4376-aca3-d8cd6b1b9a95","version":6,"status":"done","tags":[],"date":"2026-02-21T20:52:38Z","url":{"schema":"http","addr":"wlfi.bar","fqdn":"wlfi.bar","domain":"wlfi.bar","tld":"bar"},"ip":{"addr":"92.53.96.101","port":0,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"wlfi.bar/","fqdn":"wlfi.bar","domain":"wlfi.bar","tld":"bar"},"title":"WLFI — LOFT Loader","dom":{"size":4608,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"46dc493a63af9b05df5065caa8017ff7","sha1":"baef75c2665a94cb1d9d18c98b20410b83784d6d","sha256":"d4f3bb499b9db6afbab300c7469551294b4219d01853173d57f86752d02feb15","sha512":"c5b4a763c780f938b023a7224641baaac7ad3a0eecf1a09105925e6165b1392e9d09354593c41a6adf0576d3be32c7b7c78c2afe93c61966330a417fcf957f9c","ssdeep":"96:/vL2Ms0865HP6pYy63D+ABJL4nhyp9Q/U8Mx8shcYKi4:3L2Ms52ipYy63D+ABJL8WQcVrmi4","tlshash":"629143578da304566443e0769bd3370db464801f7b87c94c3e6c67c5af83559c66e7c8","dom_hash":"domhashfe5e8f46c93e219de3aaea707a264a84","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"wlfi.bar","fqdn":"wlfi.bar","domain":"wlfi.bar","tld":"bar"},"ip":{"addr":"92.53.96.101","port":0,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-28T20:52:38Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-21","alert":"Sinkholed","trigger":"wlfi.bar","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"216.58.207.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-02-15T22:14:55.382377Z","alert_count":0,"request_count":2,"received_data":77182,"sent_data":1086,"comment":"","tags":null,"fingerprints":null},{"fqdn":"wlfi.bar","ip":{"addr":"92.53.96.101","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"domain_registered":"2025-05-28","domain_rank":0,"first_seen":"2026-02-21T20:52:39.158689Z","last_seen":"2026-02-21T20:52:39.158689Z","alert_count":3,"request_count":3,"received_data":437725,"sent_data":1320,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-02-15T22:17:53.373077Z","alert_count":0,"request_count":1,"received_data":4540,"sent_data":464,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"wlfi.bar/","fqdn":"wlfi.bar","domain":"wlfi.bar","tld":"bar"},"ip":{"addr":"92.53.96.101","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"bc3377cc06f38690933eaf4456107932","sha1":"4e3892ddbafb385b0a163565f14c813498152ee6","sha256":"5dfc57eb7846d1d230a9601c1849f8ddb041c9fa981e0322e6778ee1b2416847","sha512":"da926ee6b286cf1e60bfabb4f337159363a007ef0c0c4278c484bf8d19f074fd023ff5f4eea2b814e7738c199a7c8540251071384b80ca4d8d675df9cbff02d1","ssdeep":"","tlshash":"4e21a84ba2a208a9c5c790a3c7d77a1c2d2110173657c8c97cac9bc6bfc2d10d2a2fc9","size":1329,"data":"","first_seen":"2026-02-21T20:18:32.493258Z","last_seen":"2026-02-21T20:52:41.640249Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"216.58.207.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://wlfi.bar/","date":"2026-02-21T20:52:17.261Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:40:56 GMT","end":"Mon, 20 Apr 2026 08:40:55 GMT"},"fingerprint":{"sha1":"C0:70:82:EC:9D:28:B5:4B:51:02:7A:C7:BE:63:94:B1:DC:64:29:FF","sha256":"5E:E3:2A:C0:F5:10:AE:D1:9D:11:A4:88:D0:66:44:3B:31:B7:05:05:0D:A7:35:66:17:B5:35:88:23:3C:E3:F1"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://wlfi.bar\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 18 Feb 2026 23:23:22 GMT\r\nexpires: Thu, 18 Feb 2027 23:23:22 GMT\r\ncache-control: public, max-age=31536000\r\nage: 250135\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-06-07T20:35:36.470035Z","times_seen":508571,"resource_available":false,"data":null}},"time_used":249,"timings":{"blocked":117,"dns":0,"connect":20,"send":0,"wait":10,"receive":2,"ssl":96},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wlfi.bar/favicon.ico","fqdn":"wlfi.bar","domain":"wlfi.bar","tld":"bar"},"ip":{"addr":"92.53.96.101","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wlfi.bar/","date":"2026-02-21T20:52:17.398Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wlfi.bar","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Dec 2025 00:32:08 GMT","end":"Wed, 11 Mar 2026 00:32:07 GMT"},"fingerprint":{"sha1":"A6:94:07:24:FE:8D:AE:C7:F9:AC:75:0F:B9:AC:F4:BE:6F:7A:70:5A","sha256":"BC:90:25:77:25:45:17:AB:DB:E5:96:55:3E:F9:6A:BA:EB:1E:4D:75:3B:9A:11:83:32:8E:AD:16:E0:54:87:FD"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: wlfi.bar\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wlfi.bar/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Feb 2026 20:52:17 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 196\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":196,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"62962daa1b19bbcc2db10b7bfd531ea6","sha1":"d64bae91091eda6a7532ebec06aa70893b79e1f8","sha256":"80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880","sha512":"9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7","ssdeep":"","tlshash":"c0d0129e9183638b442225907ac211d2654d13a6b87645e82d82a48a951857dc5ca69d","first_seen":"2023-03-07T12:06:54Z","last_seen":"2026-06-07T20:29:10.642855Z","times_seen":104097,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-21","alert":"Sinkholed","trigger":"wlfi.bar","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wlfi.bar/","fqdn":"wlfi.bar","domain":"wlfi.bar","tld":"bar"},"ip":{"addr":"92.53.96.101","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-21T20:52:16.688Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wlfi.bar","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Dec 2025 00:32:08 GMT","end":"Wed, 11 Mar 2026 00:32:07 GMT"},"fingerprint":{"sha1":"A6:94:07:24:FE:8D:AE:C7:F9:AC:75:0F:B9:AC:F4:BE:6F:7A:70:5A","sha256":"BC:90:25:77:25:45:17:AB:DB:E5:96:55:3E:F9:6A:BA:EB:1E:4D:75:3B:9A:11:83:32:8E:AD:16:E0:54:87:FD"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: wlfi.bar\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Feb 2026 20:52:16 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 30 Jun 2025 13:38:14 GMT\r\netag: W/\"11f0-638ca23c5e5a8\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4592,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"e13742bfb8573dfd6bed9165f7e4c073","sha1":"3eec9e5a3276f12e602a35e39c50e4651d605fc1","sha256":"64ebdb09b098430a7ae7252dc8bd35fa6178889245b78484ad12b3c0dcea9e7c","sha512":"cba8fbb9f71d32830320829e6812f06c65392615cd0c81746f4cdaf4f4d277dea134d63e707116b3d52f0b2029565f414c5de25238b3f76e8bfc6deb276d7b72","ssdeep":"96:VML2Ms0865HP6pYy63D+ABJL4nyETp9Q/U8Mx8shcYKiKD:mL2Ms52ipYy63D+ABJL857QcVrmiKD","tlshash":"fc9141575da30496a443e076abe3370db464801f7b87c98c3e6c67c9afc2549c66ebc8","first_seen":"2026-02-21T20:18:32.489963Z","last_seen":"2026-02-21T20:52:41.635196Z","times_seen":2,"resource_available":false,"data":null}},"time_used":332,"timings":{"blocked":143,"dns":50,"connect":39,"send":0,"wait":47,"receive":0,"ssl":50},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-21","alert":"Sinkholed","trigger":"wlfi.bar","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Montserrat:wght@300;500\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wlfi.bar/","date":"2026-02-21T20:52:17.053Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:40:56 GMT","end":"Mon, 20 Apr 2026 08:40:55 GMT"},"fingerprint":{"sha1":"09:4B:1C:B6:64:C5:97:5E:E3:CF:D9:FF:1A:01:C4:D8:D7:10:82:7A","sha256":"2F:A7:09:04:89:72:33:DE:1D:F8:A7:A6:EC:9F:0C:74:15:D5:B0:87:85:BE:25:63:1A:0E:73:0C:72:E3:CD:C8"}}},"request":{"raw":"GET /css2?family=Montserrat:wght@300;500\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wlfi.bar/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 21 Feb 2026 20:52:17 GMT\r\ndate: Sat, 21 Feb 2026 20:52:17 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3854,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"c6ba3244feb7a888c9ebe792f2606edd","sha1":"00889cf2bdf124da432fdd026a7bfc31a2521287","sha256":"66e6067131dbed699ce0f93e7db22c94af4b90887cdad68c2b8763bedf033ca4","sha512":"0fc2ea32935586b16b6a922c56769744647e85de75c760edea2933943d45333a6260ffd8c8458c63c85bcf9c43d8f13833e8ff47ac3bacaa4ab76a6b4d9560f6","ssdeep":"","tlshash":"5981be911057e500e6472cc923cf7e2add4e216674a4c5797ffe2ca8adeac220325b3d","first_seen":"2025-09-13T04:03:20.099718Z","last_seen":"2026-06-06T23:27:07.36763Z","times_seen":49,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":87,"dns":1,"connect":7,"send":0,"wait":19,"receive":0,"ssl":79},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wlfi.bar/Logo.png","fqdn":"wlfi.bar","domain":"wlfi.bar","tld":"bar"},"ip":{"addr":"92.53.96.101","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wlfi.bar/","date":"2026-02-21T20:52:17.055Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wlfi.bar","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 11 Dec 2025 00:32:08 GMT","end":"Wed, 11 Mar 2026 00:32:07 GMT"},"fingerprint":{"sha1":"A6:94:07:24:FE:8D:AE:C7:F9:AC:75:0F:B9:AC:F4:BE:6F:7A:70:5A","sha256":"BC:90:25:77:25:45:17:AB:DB:E5:96:55:3E:F9:6A:BA:EB:1E:4D:75:3B:9A:11:83:32:8E:AD:16:E0:54:87:FD"}}},"request":{"raw":"GET /Logo.png HTTP/1.1\r\nHost: wlfi.bar\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wlfi.bar/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.28.2\r\ndate: Sat, 21 Feb 2026 20:52:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 432199\r\nlast-modified: Fri, 27 Jun 2025 02:42:49 GMT\r\netag: \"685e0529-69847\"\r\nexpires: Sun, 21 Feb 2027 20:52:17 GMT\r\ncache-control: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":432199,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 491, 8-bit/color RGBA, interlaced","md5":"a790d14c4de707cd08428a31f310b0cf","sha1":"db37e2c7611091e9e1c905b929ea3079f8339025","sha256":"28f7c6b497d357f06c3edaf0df19c22de8198b17349e9e6fe9faba759fa1b994","sha512":"d9ae2b75aac5d60ab060e223bb9eb5f563d318dbf4a01c292624fe565897a71ba6b156f08ebdea1d60dbf3b3dd2e639320145494ba1559bb7320d02c8c7d0cc8","ssdeep":"12288:5yxOsSEXMlBlNkWLa3O3RbM+E9OYwlweEDLW:5qOpF3mO3RbMP9OYwiNm","tlshash":"339423bba6909cb0784ddf0ba5ca47082f265931e9a0892907cdcd85d214f70afd977f","first_seen":"2026-02-21T20:18:32.49106Z","last_seen":"2026-02-21T20:52:41.63894Z","times_seen":2,"resource_available":false,"data":null}},"time_used":205,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":166,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-21","alert":"Sinkholed","trigger":"wlfi.bar","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"216.58.207.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://wlfi.bar/","date":"2026-02-21T20:52:17.258Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 26 Jan 2026 08:40:56 GMT","end":"Mon, 20 Apr 2026 08:40:55 GMT"},"fingerprint":{"sha1":"C0:70:82:EC:9D:28:B5:4B:51:02:7A:C7:BE:63:94:B1:DC:64:29:FF","sha256":"5E:E3:2A:C0:F5:10:AE:D1:9D:11:A4:88:D0:66:44:3B:31:B7:05:05:0D:A7:35:66:17:B5:35:88:23:3C:E3:F1"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://wlfi.bar\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 18 Feb 2026 23:23:22 GMT\r\nexpires: Thu, 18 Feb 2027 23:23:22 GMT\r\ncache-control: public, max-age=31536000\r\nage: 250135\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-06-07T20:35:36.470035Z","times_seen":508571,"resource_available":false,"data":null}},"time_used":165,"timings":{"blocked":73,"dns":1,"connect":7,"send":0,"wait":8,"receive":9,"ssl":63},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}