{"report_id":"3ff5e230-ff8a-49ca-a24f-c4648284f9c0","version":0,"status":"done","tags":[],"date":"2026-07-17T12:20:30Z","url":{"schema":"http","addr":"shortzy.net/16turx","fqdn":"shortzy.net","domain":"shortzy.net","tld":"net"},"ip":{"addr":"185.68.16.193","port":0,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"final":{"url":{"schema":"https","addr":"tj4228.craftum.io/","fqdn":"tj4228.craftum.io","domain":"craftum.io","tld":"io"},"title":"SFR Mail – Retrouvez votre Webmail, boite mail et adresse mail","dom":{"size":9783,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4097)","md5":"5179a9c089a593c87669f134ea71aa7e","sha1":"d2af064cd82b876014035af1a1366df2d0b33001","sha256":"9b37725777473dc559f8142d75a345e1a56973ed24fa24ac1130e7271dab7004","sha512":"683ef03edada3c39c28bdceef04e7b4f1284c5f19486e658985321b2f9445856eb4f1ddc802921993cda219dec07b38df8abce97314c151e501e25d93bf98ddd","ssdeep":"192:RQCICIUvfNZTl4O9Y8mW6z+sWq4oUrebsbM/2K7:W5YvjzmF6bKbf7","tlshash":"65127315b9607896920787faf9952d041956e30fc1804cc0b32e19fe6fe8bb8adc779d","dom_hash":"domhash02151a69be24125dcf5b5d728ada51f0","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"shortzy.net/16turx","fqdn":"shortzy.net","domain":"shortzy.net","tld":"net"},"ip":{"addr":"185.68.16.193","port":0,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-21T12:20:30Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"shortzy.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"tj4228.craftum.io","ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":20,"request_count":10,"received_data":804721,"sent_data":4741,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Craftum","description":"Craftum is an Russian website builder.","website":"https://craftum.com","common_platform_enumeration":"","icon":"Craftum.svg","categories":["Page builders"]},{"name":"Google PageSpeed:1.13.35.2-0","description":"Google PageSpeed is a family of tools designed to help websites performance optimisations.","website":"https://developers.google.com/speed/pagespeed/mod","common_platform_enumeration":"","icon":"Google PageSpeed.svg","categories":["Caching","Web server extensions","Performance"]}]},{"fqdn":"shortzy.net","ip":{"addr":"185.68.16.193","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"domain_registered":"2025-03-20","domain_rank":0,"first_seen":"2026-07-17T12:20:32.061603Z","last_seen":"2026-07-17T12:20:32.061603Z","alert_count":1,"request_count":1,"received_data":495,"sent_data":486,"comment":"","tags":null,"fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"274418.selcdn.ru","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2012-03-06","domain_rank":0,"first_seen":"2023-02-21T18:55:58Z","last_seen":"2026-07-07T12:52:08.219831Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":629,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"tj4228.craftum.io/","fqdn":"tj4228.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"d4a256d81d0807a94c91729c412fa879","sha1":"83ee8b83089128e3f5106571f90d700a55664eaf","sha256":"e92d685dfd5f4d91f4fd06d881eb830dab5738fcf54e868d6e4839e7e4bc1692","sha512":"b4e44912ff921aed62d65ddcb692de88beda8f6f1cbfe5482746ac6c227d22d58fe101cb144fc6a86ccca29a3a5fe4237d41e1d87e55da40794da7e5ec967f84","ssdeep":"","tlshash":"1a70000c0028030088208200228223a02000a8028a20000200080ce0a8a082320002c0","size":21,"data":"","first_seen":"2026-06-13T12:47:17.306373Z","last_seen":"2026-07-17T12:20:38.165139Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tj4228.craftum.io/static/common.js","fqdn":"tj4228.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"02718242933e1cfceb3fff24687fb223","sha1":"b0fb1952b4fdea1e352fcc885b03dbf87df6ffd4","sha256":"b833911975bc6834a61f9ea938bd10463b02762f7ad172dc5d7f95f183f81455","sha512":"4fcc3673746bac7dd65d6eb2c9f140cd1cf4a7264d84f1e719e06edbda258c87d0db62df8ad4c34e07f946d5f7c41171a100d9d1692c71fe9a63b5bf94fd2021","ssdeep":"6144:ziWyl+m5sQXxpqoK5hMPHbjfZcTuFHqoMSL3GZq1270jEVCSk/hZ1a0R:zimQhp7Kze4IMSDoK271kl","tlshash":"53b429c83251f07243e321a681bf4106f33a5915784e8418b169e8da7c7dd9e53bbfba","size":513050,"data":"","first_seen":"2025-09-03T23:52:02.951946Z","last_seen":"2026-07-17T12:20:38.159778Z","times_seen":95,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"tj4228.craftum.io/static/a-common-styles.css","fqdn":"tj4228.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tj4228.craftum.io/","date":"2026-07-17T12:19:55.910Z","timestamp":1784290795910,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/a-common-styles.css HTTP/1.1\r\nHost: tj4228.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tj4228.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 12:19:55 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 15 Jul 2026 01:08:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a56dd93-ffce\"\r\nexpires: Fri, 17 Jul 2026 12:19:55 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65486,"size_decoded":10608,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65473)","md5":"fea45e4c927bd9032878af6b385bce6a","sha1":"f9633e62e2777454433cbb25bf9aa1478a84d5a2","sha256":"83f517dc2a2b83d9d4f26cf2ff47cd5edebf2a6f7c30f5b49d8b409e48bf0675","sha512":"89be77f84a3c5eeb3c46508a5a3dca17c2ef4d60c073148013b4c741010e6aec820037a3b098f2afe6b7c4f1f5319ab2f74ace88302a7bdd71e4e95265837000","ssdeep":"768:H2Kxq6vmEN8lK02vqJ8+97qpgF3evxvGqxqBxdGSdFxjs5SrABg:fa","tlshash":"cb535b9d34002a38a32f5813d3daa85bb1061d02ed2751d2f7a11199d5f9ffaf2b9b0d","first_seen":"2025-09-03T23:52:02.966104Z","last_seen":"2026-07-17T12:20:38.152345Z","times_seen":95,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tj4228.craftum.io/static/b-themes-styles.css","fqdn":"tj4228.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tj4228.craftum.io/","date":"2026-07-17T12:19:55.911Z","timestamp":1784290795911,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/b-themes-styles.css HTTP/1.1\r\nHost: tj4228.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tj4228.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 12:19:55 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 15 Jul 2026 01:08:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a56dd93-1df\"\r\nexpires: Fri, 17 Jul 2026 12:19:55 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":748,"mime_type":"text/css","magic":"ASCII text, with very long lines (478)","md5":"91e35e43581feb386570896502ee03b6","sha1":"16d2b7231e3b59ae3157db32c949a13fc57e98fc","sha256":"1bc2ec9a99289bde9c8a36437f35a2c194daaf0ddc061828c22416bc5b1a26db","sha512":"ccf316de76e635e0e18733d5ce3ace66117f09fabbd90c43ddd96d8754b27b55f9395ac039395360127c57bb5f49cfeff553ced8bb89f6a8ebb10421da134713","ssdeep":"","tlshash":"05f0fe4bdb3c9b3311af4c2c803cac2d12d4ddd85fe49b07b028425b6d69552e5e2a70","first_seen":"2025-06-16T10:16:03.570464Z","last_seen":"2026-07-17T12:20:38.153243Z","times_seen":124,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tj4228.craftum.io/static/c-animation-styles.css","fqdn":"tj4228.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tj4228.craftum.io/","date":"2026-07-17T12:19:55.913Z","timestamp":1784290795913,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/c-animation-styles.css HTTP/1.1\r\nHost: tj4228.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tj4228.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 12:19:55 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 15 Jul 2026 01:08:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a56dd93-312a\"\r\nexpires: Fri, 17 Jul 2026 12:19:55 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12586,"size_decoded":2050,"mime_type":"text/css","magic":"ASCII text, with very long lines (11671)","md5":"dd99176b1a4ba362fdd0fa1cd35e98d2","sha1":"e2bc6995c858d9f62aceb085f850f249b8ea8b79","sha256":"ffd61699a43a8425b1f6508d30acb3cab0d6700188f8497c297a8f5b10d5d633","sha512":"cf31f3e9843feb46720a6b957e47eef482b263e67cfd41898610a3b8c4eaca0b89d041649f04ef34339542f33052aba23b7929a3ee246f1dbd79eee9278d047a","ssdeep":"192:uW6uNQ3fdPwwanleMf72yMHdMTQEQaLQ0:f6uNQ3fdPwwanleMf72yMHdIQEQaLQ0","tlshash":"91426cda50c1560d86574bb283cfde044a3c8ca1652168f972a5694e8f47fd8e3bf13b","first_seen":"2024-12-26T05:41:43.339442Z","last_seen":"2026-07-17T12:20:38.154063Z","times_seen":126,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tj4228.craftum.io/static/d-simple-styles.css","fqdn":"tj4228.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tj4228.craftum.io/","date":"2026-07-17T12:19:55.914Z","timestamp":1784290795914,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/d-simple-styles.css HTTP/1.1\r\nHost: tj4228.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tj4228.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 12:19:55 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 15 Jul 2026 01:08:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a56dd93-939b\"\r\nexpires: Fri, 17 Jul 2026 12:19:55 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37787,"size_decoded":7648,"mime_type":"text/css","magic":"ASCII text, with very long lines (37786)","md5":"46e65c08cb220ab39cb30b93a108c1a1","sha1":"0361df7694002c7cc8d177d97179f59ffb0fb4d3","sha256":"c8a28435efa8f24cac4b8ce52c81095b6b1308a31900ed0b8bf43023dd5bd245","sha512":"16f489642893f1f0834544bb5d5539409b21714e2fffc9cc0310f8e76e45bb2ecdbf5760a4de1c8cb7b2726e5a78a8dfa9913d123ebff15dd3b355704403f25f","ssdeep":"384:27mJU20ZjFfWAbnBulukvQelGxXr4GDyK+UVSj7D0k:hATBulE63R","tlshash":"eb0360679171123d340f98757758aaafa309d00bde3613e6fa819535a3c6af708327ce","first_seen":"2025-08-03T21:09:00.891659Z","last_seen":"2026-07-17T12:20:38.155428Z","times_seen":102,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tj4228.craftum.io/static/f-blocks-styles.css","fqdn":"tj4228.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tj4228.craftum.io/","date":"2026-07-17T12:19:55.916Z","timestamp":1784290795916,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/f-blocks-styles.css HTTP/1.1\r\nHost: tj4228.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tj4228.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 12:19:55 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 15 Jul 2026 01:08:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a56dd93-5c7b\"\r\nexpires: Fri, 17 Jul 2026 12:19:55 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23675,"size_decoded":5102,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (23644)","md5":"aa8d73f1b473ead827350783f5d1c314","sha1":"8d646fbb70c5364c01bd8f9eaca5f2548aba0a42","sha256":"9ddf34f38517b545cd688276cd7c2c22dcf3a0f315a816754ac7092a3d14a49b","sha512":"c75fa25873e24f03d49e58c2ec615703d177605fa43cbd6c8ccbe40d4c888253da4268792fe773e6d6bd14eda5f103a8ee91979dd3129c5c32c9d5f232bc48bc","ssdeep":"192:AxCQjdXWtD75VWAkEA1ShsHcouDcfupeb9njwcBGzh+S5:AkiXWtD7zArmsHcouDXebk","tlshash":"82b2ff4820660238b21f8aa56fd3d07f36545839d7faa9f6fd128818d7cc7c58472bad","first_seen":"2025-09-03T23:52:02.980162Z","last_seen":"2026-07-17T12:20:38.156207Z","times_seen":95,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tj4228.craftum.io/static/g-libraries-styles.css","fqdn":"tj4228.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tj4228.craftum.io/","date":"2026-07-17T12:19:55.918Z","timestamp":1784290795918,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/g-libraries-styles.css HTTP/1.1\r\nHost: tj4228.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tj4228.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 12:19:55 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 15 Jul 2026 01:08:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a56dd93-5056\"\r\nexpires: Fri, 17 Jul 2026 12:19:55 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20566,"size_decoded":6357,"mime_type":"text/css","magic":"ASCII text, with very long lines (2240)","md5":"a74472ad7619e0ea94ac1adb81ba9a23","sha1":"56f2efe06f86c35cefa7e68e4a1b72c93c5fa135","sha256":"fd5c89c5619ff294e7889a72ceee798404e8c4a2b9b09516438848dd47006ad2","sha512":"ba236641cc822a1ae908f1969298255980a5893522242dc0cb32276902b24ac737d469c44c206ee595430236525fcf3ea122c8d7391ffe10ab7dbeecc01a79cc","ssdeep":"192:6L1mUJbiKneQhSewe4atkti0iBE4bcGbwM1FpqWUzzR+pvdaaYYVweCdhW4APnqF:6cUbek3tLqi0iBE4bzpTU+KCCy4Kmf","tlshash":"d192f39453b01c27172f4e6a1a624779f6a454c10a4bcc7993d0ac48ffb59fc331faa5","first_seen":"2025-03-20T08:48:33.72298Z","last_seen":"2026-07-17T12:20:38.157462Z","times_seen":125,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tj4228.craftum.io/static/bec8b921-d519-4d46-b81c-64605f1e90d0.css","fqdn":"tj4228.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tj4228.craftum.io/","date":"2026-07-17T12:19:55.922Z","timestamp":1784290795922,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/bec8b921-d519-4d46-b81c-64605f1e90d0.css HTTP/1.1\r\nHost: tj4228.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tj4228.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 12:19:55 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 15 Jul 2026 01:08:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a56dd94-23e\"\r\nexpires: Fri, 17 Jul 2026 12:19:55 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":574,"size_decoded":713,"mime_type":"text/css","magic":"ASCII text, with very long lines (574), with no line terminators","md5":"25ce96e65dce7720bf2de6031c14c8f3","sha1":"eb6903304ec864b9804d1297085ded877dab9629","sha256":"165315661c96570fd0f9cd9f29b8de716f4d3b50548c7fdb38862212b10d5d27","sha512":"0857b3ba0c66b9bd41b03354917c6402429a0f850b166dce5fed8b836195bb1e84dd240a65b3351878fb61acaa1fedb9813ffaf50819ef4f24527f4f52865c88","ssdeep":"","tlshash":"75f04087abd6000f3dab01cb853880822b0748c7cd1c3f1a08167af03b852eea072bd0","first_seen":"2026-07-17T12:20:38.158516Z","last_seen":"2026-07-17T12:20:38.158516Z","times_seen":1,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tj4228.craftum.io/static/common.js","fqdn":"tj4228.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tj4228.craftum.io/","date":"2026-07-17T12:19:55.923Z","timestamp":1784290795923,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/common.js HTTP/1.1\r\nHost: tj4228.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tj4228.craftum.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 12:19:55 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 15 Jul 2026 01:08:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a56dd94-7d41a\"\r\nexpires: Fri, 17 Jul 2026 12:19:55 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":513050,"size_decoded":189196,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65436)","md5":"02718242933e1cfceb3fff24687fb223","sha1":"b0fb1952b4fdea1e352fcc885b03dbf87df6ffd4","sha256":"b833911975bc6834a61f9ea938bd10463b02762f7ad172dc5d7f95f183f81455","sha512":"4fcc3673746bac7dd65d6eb2c9f140cd1cf4a7264d84f1e719e06edbda258c87d0db62df8ad4c34e07f946d5f7c41171a100d9d1692c71fe9a63b5bf94fd2021","ssdeep":"6144:ziWyl+m5sQXxpqoK5hMPHbjfZcTuFHqoMSL3GZq1270jEVCSk/hZ1a0R:zimQhp7Kze4IMSDoK271kl","tlshash":"53b429c83251f07243e321a681bf4106f33a5915784e8418b169e8da7c7dd9e53bbfba","first_seen":"2025-09-03T23:52:02.951946Z","last_seen":"2026-07-17T12:20:38.159778Z","times_seen":95,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"shortzy.net/16turx","fqdn":"shortzy.net","domain":"shortzy.net","tld":"net"},"ip":{"addr":"185.68.16.193","port":443,"asn":200000,"as":"Hosting Ukraine LTD","country":"Ukraine","country_code":"UA"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T12:19:54.642Z","timestamp":1784290794642,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.shortzy.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Jul 2026 00:12:12 GMT","end":"Mon, 12 Oct 2026 00:12:11 GMT"},"fingerprint":{"sha1":"61:9F:51:E5:29:F7:2C:94:19:77:4D:93:11:96:17:D0:E1:CC:C8:67","sha256":"D1:58:95:EA:EE:14:D3:77:EB:E6:5C:C3:8B:B0:2B:C4:C4:6C:B9:1F:97:FF:77:7E:46:52:DD:48:9D:23:F8:4D"}}},"request":{"raw":"GET /16turx HTTP/1.1\r\nHost: shortzy.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 12:19:54 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0\r\npragma: no-cache\r\nexpires: Thu, 01 Jan 1970 00:00:00 GMT\r\nset-cookie: PHPSESSID=56197021bc2077090c5a6abe9d17c826; path=/\r\nx-ray: wnp21557:0.010/wn21557:0.010/wa21557:D=14425\r\nlocation: https://tj4228.craftum.io/\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T14:40:26.336623Z","times_seen":17316417,"resource_available":true,"data":null}},"time_used":334,"timings":{"blocked":-1,"dns":101,"connect":53,"send":0,"wait":68,"receive":0,"ssl":111},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"shortzy.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tj4228.craftum.io/","fqdn":"tj4228.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T12:19:55.257Z","timestamp":1784290795257,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tj4228.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\ndate: Fri, 17 Jul 2026 12:19:55 GMT\r\ncache-control: max-age=0, no-cache\r\nx-page-speed: 1.13.35.2-0\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Craftum","description":"Craftum is an Russian website builder.","website":"https://craftum.com","common_platform_enumeration":"","icon":"Craftum.svg","categories":["Page builders"]},{"name":"Google PageSpeed:1.13.35.2-0","description":"Google PageSpeed is a family of tools designed to help websites performance optimisations.","website":"https://developers.google.com/speed/pagespeed/mod","common_platform_enumeration":"","icon":"Google PageSpeed.svg","categories":["Caching","Web server extensions","Performance"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10331,"size_decoded":3249,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4625)","md5":"d4eb1ef4e7553c5f4bc4561d824f7094","sha1":"db61cef248ac9ac9229d169c7c1ac4ae390f9085","sha256":"2bd34f95d5c06b31c9d979829293fd3d83bf3a360adbd5c9bcc1a129e19cdd53","sha512":"3da6138ca1063e0ea648287b51189b9189b4d4f7b747f86de579f7567d114ba977211541155785317a03a62acbc37657ffb66de993dd5d181f27fb70eb0fef80","ssdeep":"192:deC/CMUa8NZTWW3O9Z8mq83zLz7BWuF4oUPWnbsbM/2K+u:gIsaSpmZ3f8uiPGbf+u","tlshash":"28227206b8b07495920782faf9942d052957e34fc2804cc0b32e19f96fe9b78adc779d","first_seen":"2026-07-17T12:20:38.161916Z","last_seen":"2026-07-17T12:20:38.161916Z","times_seen":1,"resource_available":true,"data":null}},"time_used":215,"timings":{"blocked":-1,"dns":128,"connect":19,"send":0,"wait":20,"receive":0,"ssl":48},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tj4228.craftum.io/static/e-complex-styles.css","fqdn":"tj4228.craftum.io","domain":"craftum.io","tld":"io"},"ip":{"addr":"92.255.111.71","port":443,"asn":9123,"as":"TimeWeb Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tj4228.craftum.io/","date":"2026-07-17T12:19:55.915Z","timestamp":1784290795915,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.craftum.io","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 17 Nov 2025 06:20:04 GMT","end":"Sat, 19 Dec 2026 06:20:03 GMT"},"fingerprint":{"sha1":"20:1C:E6:28:A0:C0:0E:A7:23:A5:2B:49:E6:04:A2:58:8E:47:C6:67","sha256":"28:99:7E:0B:A8:36:4B:91:A0:6F:74:50:37:C7:55:57:7B:12:21:1F:7C:D8:23:B7:CD:AA:A2:78:E7:33:4C:59"}}},"request":{"raw":"GET /static/e-complex-styles.css HTTP/1.1\r\nHost: tj4228.craftum.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tj4228.craftum.io/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 12:19:55 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 15 Jul 2026 01:08:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a56dd93-1c0cd\"\r\nexpires: Fri, 17 Jul 2026 12:19:55 GMT\r\ncache-control: max-age=0, no-cache\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range\r\naccess-control-expose-headers: Content-Length,Content-Range\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":114893,"size_decoded":18281,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"61923fb93151b054d41002aa5c040fe5","sha1":"405947d8aa729ebb6e3b50c6e44f545b9f64785e","sha256":"ce0513574fa11d0a0c9d978e43b865630af9381a9b7a068b0ccf063c6e2f906f","sha512":"1e3b6ccfbb77155aef5ec785d8e9460f95cdb19f866419b469bc574b336d50bb3811e68cfb2b54ad61d176308e1d98978f63efcf06b15aba0a4839d231298fa0","ssdeep":"384:4D+JvUy2vqpmkfGMGGC/LaqKLhiwbmnnBWb54OCzeX990y7ljq79Z1G95QhgEwhU:aCpYMALchgBG5gw0SlWkeeOq9g4RLFFe","tlshash":"c7b3852671703739652bcd259b94d99bb310d112c63722fbfc90d91cdbcab9241a3b8e","first_seen":"2025-09-03T23:52:03.088938Z","last_seen":"2026-07-17T12:20:38.163105Z","times_seen":95,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"tj4228.craftum.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"274418.selcdn.ru/cv08300-33250f0d-0664-43fc-9dbf-9d89738d114e/uploads/790662/59c17280-5736-45f1-af66-241a5b5013f4.png","fqdn":"274418.selcdn.ru","domain":"selcdn.ru","tld":"ru"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tj4228.craftum.io/","date":"2026-07-17T12:19:56.115Z","timestamp":1784290796115,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /cv08300-33250f0d-0664-43fc-9dbf-9d89738d114e/uploads/790662/59c17280-5736-45f1-af66-241a5b5013f4.png HTTP/1.1\r\nHost: 274418.selcdn.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://tj4228.craftum.io/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T14:40:26.336623Z","times_seen":17316417,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}