{"report_id":"40052edb-43d6-4baf-9316-ca5989ec95bc","version":0,"status":"done","tags":[],"date":"2026-09-20T10:22:53Z","url":{"schema":"http","addr":"zahrabeauty.ca/","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":0,"asn":55293,"as":"A2 Hosting, Inc.","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"zahrabeauty.ca/","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"title":"Zahra Beauty","dom":{"size":121761,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (28310)","md5":"283860db91fa6d37b7aea349d9c28f7e","sha1":"08ec094f355af7532bb167d9b1d8d4e33025ad64","sha256":"2c0bca869da84900b1b00fd2acb3627b1c3c6fd596c8e5842ee852bbe86b9bb1","sha512":"d684529edae045c59a9cd827d08ee42b3e0136507b11c6328835f86a6d3950d5a52f7a5e16bd6d538ea87818db87e82756b2d34b95b3532b5ff6133a43d9f210","ssdeep":"3072:ACyCsCVC8xbw3STfr+wwvj9Be3dfG15wyNn7C9CAuABlGUwqGU3Wyuyayiy8HcQK:hmj9B6+AhmvddxPimIN9","tlshash":"47c3c7337d50183a112b03d5e0aaaa58ba62fb01c70b5ad8b1adc1b46fc5df63d3674c","dom_hash":"domhash12c04a0e052d4c7052509803c26cd430","first_seen":"2026-09-20T10:23:11.909785Z","last_seen":"2026-09-20T10:23:11.909785Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"zahrabeauty.ca/","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":0,"asn":55293,"as":"A2 Hosting, Inc.","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-25T10:22:53Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-09-13T22:43:30.746969Z","alert_count":0,"request_count":5,"received_data":145359,"sent_data":2782,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-13T22:43:30.72904Z","alert_count":0,"request_count":2,"received_data":29062,"sent_data":1081,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"zahrabeauty.ca","ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"domain_registered":"2025-03-17","domain_rank":0,"first_seen":"2026-07-02T03:59:33.974068Z","last_seen":"2026-09-20T10:15:20.852088Z","alert_count":220,"request_count":55,"received_data":2328290,"sent_data":28376,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"imagesLoaded:4.1.4","description":"jQuery plugin for seeing if the images are loaded.","website":"https://imagesloaded.desandro.com/","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"WordPress:7.1.1","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"PHP:8.2.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"wpBakery","description":"WPBakery is a drag and drop visual page builder plugin for WordPress.","website":"https://wpbakery.com","common_platform_enumeration":"","icon":"wpBakery.svg","categories":["Page builders","WordPress plugins"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","size":13577,"data":"","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-09-20T13:43:23.71035Z","times_seen":971658,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"8c649be6a89d7f1c37a24eb3886455ed","sha1":"64febba877f4af279df393207776f5259a7325dd","sha256":"792f8eb43b20737f2997060bcc3b110bbd5022cd910994e2635111fd1f089af8","sha512":"65fd4829e132e9443f61edc63655d5be6037b1e90705fe68e73cfffe4b8ebd40918113bb22c5fe704d468ccf668560ca30d99762e97b6d8d65ba235d2b169327","ssdeep":"","tlshash":"7db0126b10c020334c5eccc5588080972824227412013302948cd412843ad400c23388","size":90,"data":"","first_seen":"2023-03-07T13:58:08Z","last_seen":"2026-09-20T11:19:35.736667Z","times_seen":1549,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"98143366cd479fe7dbd592570917c70b","sha1":"52e966a299413cd1fb61d3c2c950d960ec5add57","sha256":"54a8b71ae610bee2eaf9e909cce3308fb32dca5b95ecbba84199b6de7e22fe11","sha512":"3dc211e3b6ccb567c480a8dfcc74e7e73c90c10e473f605bedf6e6397dc089b204cdbc2440eabac3735ab6b635d8ff5ac9d6fc03fbfa46932419e22b9b6220b6","ssdeep":"","tlshash":"f5019067920c5227142727a15d5d51cf3a3f115355870cb75c5d8a10f7d9873061dff8","size":724,"data":"","first_seen":"2024-01-12T23:28:31Z","last_seen":"2026-09-20T10:23:11.960999Z","times_seen":209,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"df37c600f77292e36a910c2201f03dab","sha1":"7c5d601ff1f12f96052a325136f18b878a9cfad8","sha256":"66fc3cdfb8303b09ed33d570061572ff989ff1dc07d3573c8da4490f01d8337b","sha512":"1bf8bcc34b8a35789b02f4c9875df1c7fb633452e0088a7c886a3841dd81510f163e62bdac7a1eec79d0119657810ed0f925d73b52559487a51cb6f3a23de03f","ssdeep":"","tlshash":"3c115941f4601d7b13df1fdca4cf466178e80954e0913990e9eed9295bc6992a2c728e","size":907,"data":"","first_seen":"2026-09-20T10:15:22.546059Z","last_seen":"2026-09-20T10:23:11.961718Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/jquery.easing.min.js?ver=1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"56ba0cdb72b1b00226a21fe08251054a","sha1":"82bef20f71eb674c7d1d63242c80afbc1e6d8274","sha256":"15a71d32b340bf3641581ac5b4f37887b9cb3981477d5886ec5849749c8a36e7","sha512":"6f33bbc08a61ff3fbfd3533f16355f7c804f2c151496da3ff0bc14939e7baa44ca7da56bc93fb555afd59e1ace12beb8deccf3e3fa208ae66d66b8d4f40ba718","ssdeep":"","tlshash":"984129c9b9c3b75e935275e0162f200bb76e6ea000ed2530c66178aa7d3431d9d3bacd","size":2392,"data":"","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T11:19:35.710868Z","times_seen":7352,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/nectar-frontend-js-extra","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"526da0aaaa55928b9d5b435e31eae495","sha1":"885a1741fcf910880290587b688df99110a0096f","sha256":"28e24f0afd77450ed97e862474ca31cd44a219e3672db9ddd28ae694e10d2ea2","sha512":"c0dc886bc05822f3ffac93e14c29415be99700355dc78133f4c0ba15f93567626a0f445a56a37a81186012279571132df358c8903908a7b86db3c18e0e1bd63a","ssdeep":"","tlshash":"0f415941f4601d7b13df1ffca4cf466278e80954e0913990e9eed9295bc6992a2c728e","size":1995,"data":"","first_seen":"2026-09-20T10:15:22.547433Z","last_seen":"2026-09-20T10:23:11.962591Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/plugins/js_composer_salient/assets/js/dist/js_composer_front.min.js?ver=7.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7493ac7b2815c1b0db6ec26a2080b625","sha1":"35b090889db267c357c08a2bd28f4a9fc199d796","sha256":"af6aad45dfea3dad21ae2d7d9b2b44e7ee84ec9b9df016489ec4f003edf1314f","sha512":"0eac8f30eafdf236ca0d8e96599ce6dae7a99eb4e48aeafbcb2e9dd0a239aa8aac7145ffcf32719e90e0d505c5bccc89f4eb6b367af49db3adfbca0c9983a9a3","ssdeep":"768:WKiitGHBpfOiaCKaUGia7tyIADu8vVeTUVEMm7BGBS:TtEJz5Zy/Du8vY3","tlshash":"65c2851e74b430a491773a36a93faa1871371437600e75103d4ddab82f7a82e527afed","size":26583,"data":"","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T11:19:35.607716Z","times_seen":2079,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-includes/js/wp-emoji-loader.min.js","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"71303555bd9e652a2f741df19595b65a","sha1":"1aeec4301f0c45d6ae2cf05b85a5dd2d672d3432","sha256":"feb1908d93d5f39d3386ff970db9684107e7494e7be5f3bd0e5dbaa3133f08f1","sha512":"c39028f0178bafe3b3ed7a597a2aaf45b397e119c314a0d8e5e0253eceaa473d08ec9d4ce1f906f5c381f19489c7f01f3a6961fc855a6ed7e94b807474ffc275","ssdeep":"96:4rsjXHtHRANNTDmgMjE0+eWjQPHgRhRU4omJt:Ms7NAME0+eWjQvJB4","tlshash":"9181a699eb7938df33fa01f3653a4d4beb614436e784d038c9ae631424b1893c375a5a","size":4152,"data":"","first_seen":"2026-09-20T10:15:22.548751Z","last_seen":"2026-09-20T10:23:11.963265Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/priority.js?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b08178f9f045f881029f695e4b939291","sha1":"e62866a6042f4f2a0ca8bf8621f550803ed0f006","sha256":"2ff736ab797eedc5190bf7dae8ff0bd0dcd546d7cce417ed909a608ce385acd8","sha512":"c4e70efd0652460e72cee7c7e68244d24b3f8a3ba5f8b6a322c71b4cf55b022d454b19de8092fff8f3c47e1db676b4b9b8ebf8a6dd962739922d37dbb0c0252e","ssdeep":"","tlshash":"eb4131723100bd7156bf2d87fa8a7f4a229096510a155100f31c483f29e4ee7fdbb7a5","size":1922,"data":"","first_seen":"2024-01-05T05:20:59Z","last_seen":"2026-09-20T10:23:11.937797Z","times_seen":5174,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/plugins/salient-portfolio/js/third-party/imagesLoaded.min.js?ver=4.1.4","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e2c1a80b99251b7b94726b41312fb160","sha1":"6d3e11174e22668e69df236e5c4542168f7cbfec","sha256":"96abf166b3cbb5f7df525d86fdeeeccea4af3c120b19bc26b0613530a94e8b44","sha512":"4b93d9f46c4964ed7ab53f6bdd6269fd269f9f7d5ebbcb96af382531a8434f876c9a0a96a27458f60ae4de3fb7b5fb8fafd58936c7e8a0e47b1a2ec72f95b68f","ssdeep":"96:bwRxr6JAXgWWwrrSTrmM4KvlGC89QPjRxq2uVBXeHRGKrc4oPUGPgNhd+qLoBV7J:bwjrycrr3rKvE9IjRxjGjgNhdTLo3re+","tlshash":"19b122cd77a27535229af0b3a21f020f72b6406e6918815d7959ecf65cfcd192633bb0","size":5594,"data":"","first_seen":"2023-03-07T01:03:01Z","last_seen":"2026-09-20T13:38:42.515495Z","times_seen":24908,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/superfish.js?ver=1.5.8","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"beca72584b7b6df68f09cd56acd813cc","sha1":"c3788c2e7bcfbdb9067fb5579e9cf323609a2187","sha256":"e40c49d2d7cfc035902c7b8471e9736b9a05b2adc59ed919567063676d3b793e","sha512":"1667bb61b00af922a31e247b96ca2641faba9500020bf27f957caf91f87f582d832b6dc3b4c885e5031416c871b8f803cd13d670614ae5a76b351786bab71b6a","ssdeep":"96:PQlNKX1zRos8L1M8EZI8Y2VWSfxUeNBhQ4lMq3Yd2HD:PFusSOu8YxuDh1L","tlshash":"a8c1c7c8b24650f263fb6b99907e6606b1b61a1ca8284114f5379c7a0f6fc44b273f3d","size":5692,"data":"","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T12:00:46.014169Z","times_seen":3539,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/plugins/salient-core/js/third-party/touchswipe.min.js?ver=1.0","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"20f13f992fd02ead68fb17893467a8b5","sha1":"8b37d46d93eb907cf0f8f95c3220eda45387389e","sha256":"cb225cbe89436bb47d3b4486cd9cee63db751cdaf60409f496253ca8be549dae","sha512":"cbcbd38dc2176f280c94d561fabb45f68fde3d0417c9d60100ad9c8360828501be5615fdc3acdbd3d3722c3a6327ca8b4e21590963850ae1f29c375dabab9e62","ssdeep":"192:KKirvjKPsO/kAvi8uErTNi7OasUrxq0G/2X8EpW7QYovE3aCn9h:KtesO/kAOErTNiSasUNqpo8EpW7QYosp","tlshash":"661275c67622b217a6d82276d31f0b57661e6c63192ac571f0b2ec50fb340b4627fbd8","size":9375,"data":"","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T12:00:46.00689Z","times_seen":7524,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-includes/js/wp-emoji-release.min.js?ver=7.1.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7dcb0bb1f67bc5cd9aa86bc0577108e3","sha1":"c90b1ed149a278c322a63f3a79443ccce5592382","sha256":"063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3","sha512":"d09c60fc702e1d3fb839685770b2626a64cbc6373ac4bf3a63c3536caef34f4f6caf76adfbd5c2d15bed6e1396ed4f3ca80f6673e3421b2ae2f9e7aa5ccf16f2","ssdeep":"384:WzevzApRZTbbUL3px/bEg1XgA5OOkpJTX:Wsk9bUL3px/YqXgAP+hX","tlshash":"79a2949ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c90","size":22752,"data":"","first_seen":"2026-06-05T05:27:24.795617Z","last_seen":"2026-09-20T13:54:31.745336Z","times_seen":58533,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87553,"data":"","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-09-20T13:41:49.22254Z","times_seen":1062945,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/jquery.mousewheel.min.js?ver=3.1.13","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2a651f118ed794f9bdc86ef7eb86859a","sha1":"044daf3a8f2789d7b80948dcf640bb72775f9df0","sha256":"c962e74a0cd768609b29c247028bd61c3229a50bb3abe908feeaa98962eb0971","sha512":"29a20f42ba55bcde7849aa21b8a26be89d0911cf480197557fd53c12566ab076ba56c34b789ada36b41b679b0e5017ea2f845f767dcd0041c0f5ab1c9bb616d1","ssdeep":"","tlshash":"7a514158771632f341fa1b29e12f7702703bd026104220a2b6bd9d80bb56eeb5367e1f","size":2711,"data":"","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T12:00:45.99204Z","times_seen":6212,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/hoverintent.min.js?ver=1.9","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"507093401cd1d74603963e9a93012460","sha1":"40920e71e0dc7b172c80ac5905f9a9c42aa8acf0","sha256":"86a156b80c4342d46aa6bfdf42944e34cd85f5935e38c20bd58445006ca12a96","sha512":"954aa6351d223570b9e8e22cf329c2020d114d0da46fc5d62109fbdab4de4f29fd14bf56fc7c831bb65609fd2120dd198990b3c47034d0ea5d1b1f3540e4dd1d","ssdeep":"","tlshash":"cf411e4d270924185bd79ba0603ff87ebb4e156ba50d09d1b3776a4c3ca6c29022b79d","size":2245,"data":"","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T12:00:46.01354Z","times_seen":7507,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/jquery.fancybox.js?ver=3.3.9","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7270c88429fb55fdfed258cd32beb804","sha1":"732d27a9a7b89cea06a51b8c048bcb21c12262e5","sha256":"3ce9be76f458848a316e79e59b1f08598f7bb71778871a34bd9c469772459728","sha512":"2bf6d1726e08b3d79e6f396dd19fd0894157dbb1d2662c79872784bfaf0b493faa4b7a6e9cd4d9b449e26a807b1235b35835b8aed27d4c8d376e454a8718c1e3","ssdeep":"1536:zUtGulsqqQzeFuouppK0WEJnsQrNz7M4HJ3t5oSKN1fQq58cTJ7PBTf:6GasqqQzeFuoubK0W2Nz7M4pd8qq58cH","tlshash":"0163f89fb650702582bb0594a30f520ed137711af10284fa78bdd4d55ae4fc922ebbfa","size":68855,"data":"","first_seen":"2023-07-19T23:18:28Z","last_seen":"2026-09-20T10:23:11.919477Z","times_seen":2880,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/flickity.js?ver=2.3.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8bef3766446b7967077c629d96d146d0","sha1":"e7104c7ad2c7286eaab232476b6c75588877e1e1","sha256":"25cacb6853bc8fc8141a59af840cabd5b41c9bbce1e8accc4c19783949d3d5f6","sha512":"80579356ae23a201d0c808512ec36ff02dfdc7770ef065ee7f2450aeb55255fb3474eb688bf90e63ab98940656c14ecca3783a41e699e02c865471d80a10324a","ssdeep":"1536:DxD9oOEJ3FavYdgxV6sXUlniAvJE3J12/tUDP8tDcl3far5hEA9+rA+/:DEOWrO3JR1Ug","tlshash":"2a43764eb2413936418fb1a6621f460fb2b364ad140180acf5a9ecda5dfcc8d647bf79","size":55498,"data":"","first_seen":"2023-08-05T16:35:32Z","last_seen":"2026-09-20T10:23:11.944721Z","times_seen":903,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/transit.min.js?ver=0.9.9","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8e9392ec75b6ef18ba671a0a4432d1b1","sha1":"7e7a63444fb918382d51bd2f7bd3757c0434ff10","sha256":"fdcb39eec676f0d52a9647156d6e1c5e0668ebdbb1060cb8ff89d5b4ab4695e8","sha512":"5e3b713b57787ff0093a86b7b91180c7eb878cd652080258fd094ce4f978881795126671ee9ab0bc782310d8aa2ff83af6733cb0e4fa6a0a57fe611062275890","ssdeep":"96:PEcg7lrL7LMgkubetbEL/Q0O3fWt2GANOr+FDVq26A00NmSvzuzGyXPn1BBLt8:Pi7lrPVSbV5y+FUVb4","tlshash":"8ee194557a90b22c02bb613081df1846203dde6737a9f55af321e4a7acb540d835bfbe","size":7416,"data":"","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T12:00:45.940063Z","times_seen":8050,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/waypoints.js?ver=4.0.2","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"900bad1dbd9b131a99f31703a66340f3","sha1":"ca580144be55dabae951a984529a5250d279b129","sha256":"3c9eb9bb1076bbb11745885964334df870bf7eb621daa5e7475a9a5cf4b2e424","sha512":"d0cf2c673096b76e4018a4a7f2b900570ba0094116e69ba4528b96e27f5339cd20a1ccd68adbba0f1e1d854cff08a7ea10605d75d04ac5be3e2f8cd1da04a552","ssdeep":"192:NKasXzHD9D5/6J8bvctcfqqTapzikrCeexsvfip9Y8pY7pZpz9n+HyQ8m8Fwmtre:wjzHD9Dpm8L2cfqqTapOeexsvfip9Yne","tlshash":"9802748d750134221b9f91b9e91f434ab337582ca40580bdb0d4d4ee28f252db76bfba","size":8999,"data":"","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T11:19:35.648058Z","times_seen":6505,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/anime.min.js?ver=4.5.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"572d66e85091711b6ee76609573a8364","sha1":"332031949d78a49e8a18611556253660574e47db","sha256":"5cbda29ea5096ac9404c59c77493a2f467d0eb4a27f16c750b61fc0d888dd716","sha512":"cf8394ab0dfca8d2e99f59626c037d06ca03c7a9db3458a8e6503a0ae4e9f4d94af376fcf61832095abe37915d049a6d20dcedc67d59dd268a48a512e543fad1","ssdeep":"384:f7LTpKyzqrGGpLZo12xhMFoFlm5dwi7SeigzrLL:XTppX12j2LD7SeH","tlshash":"e982a7cc32c3b496539395b1806f244bb23e5d8064ad98a0d669f1f43c3495d89bbefd","size":17741,"data":"","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T12:00:45.93545Z","times_seen":11254,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/init.js?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a0356157d149b7bf1cf2ec157ae56e32","sha1":"6b659af962163268f4faadf9e4cac107d32cd1c5","sha256":"d05732efd6c3c6ab81b8591dc5b0ea738487223630b9e72aaf55075616424c08","sha512":"872d3f07f04406c9c8728f6afdc28b3eaa206d20bb058a38bf9d99afea1452c90b8afa1751fe177485b0b50e07f92bd5b05e38295a60cfdc66c42643ec1c4ee7","ssdeep":"3072:nBEeoWyyu+qzb1ACPRpDp2AmtpNvgQ8Qp+J3262whGAzHDcHMHHfXhJe62tIbz9L:nF6ygCCPRpDpl5MAzHKMgI+u","tlshash":"7384f94ab610227652ff0792909f790522725c35cb024559b1bad4f90cbaedc32bfb7e","size":375431,"data":"","first_seen":"2024-01-05T05:20:58Z","last_seen":"2026-09-20T10:23:11.922668Z","times_seen":329,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"JQMIGRATE: Migrate is installed, version 3.4.1","filename":"https://zahrabeauty.ca/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","line_number":2,"column_number":981}]},"http":[{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/build/style.css?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.420Z","timestamp":1789899740420,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/build/style.css?ver=16.1.3 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 18:57:41 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 29000\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":168869,"size_decoded":29436,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"6e7d81fbc3e82669f10db52ce76f3ede","sha1":"04f999e28d83e6defb33cf8bd49e48d14e151a21","sha256":"5ff660fa21052bee0193098500c35ac9c3ec882149cf4926f37e3b68012efd3c","sha512":"2b176f5395ed34390c8ef4cd9cd6558a793f55a2692cf90c6d87327deb48b36d361567de6373492190415c3de77fb0ed7c349244b7a4ef17a7c1c16e581e9579","ssdeep":"1536:7i9FKQURh9dWCBU+A/Mo+nDQ3RPJfKnx7v1gm+m1NXs3J0oHL6Ui68G5TCecjlT7:PUzNVi/rj","tlshash":"06f3e915b988222977238335e4c8b7242e34a513d7530fdef969942e87ca2d6317b3de","first_seen":"2024-02-24T13:54:53Z","last_seen":"2026-09-20T10:23:11.912283Z","times_seen":273,"resource_available":true,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/plugins/salient-portfolio/js/third-party/imagesLoaded.min.js?ver=4.1.4","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.637Z","timestamp":1789899740637,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/plugins/salient-portfolio/js/third-party/imagesLoaded.min.js?ver=4.1.4 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 07 Apr 2025 18:59:06 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1712\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5594,"size_decoded":2114,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (5477)","md5":"e2c1a80b99251b7b94726b41312fb160","sha1":"6d3e11174e22668e69df236e5c4542168f7cbfec","sha256":"96abf166b3cbb5f7df525d86fdeeeccea4af3c120b19bc26b0613530a94e8b44","sha512":"4b93d9f46c4964ed7ab53f6bdd6269fd269f9f7d5ebbcb96af382531a8434f876c9a0a96a27458f60ae4de3fb7b5fb8fafd58936c7e8a0e47b1a2ec72f95b68f","ssdeep":"96:bwRxr6JAXgWWwrrSTrmM4KvlGC89QPjRxq2uVBXeHRGKrc4oPUGPgNhd+qLoBV7J:bwjrycrr3rKvE9IjRxjGjgNhdTLo3re+","tlshash":"19b122cd77a27535229af0b3a21f020f72b6406e6918815d7959ecf65cfcd192633bb0","first_seen":"2023-03-07T01:03:01Z","last_seen":"2026-09-20T13:38:42.515495Z","times_seen":24908,"resource_available":true,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":251,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/anime.min.js?ver=4.5.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.640Z","timestamp":1789899740640,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/js/build/third-party/anime.min.js?ver=4.5.1 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 07 Apr 2025 18:57:43 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 6960\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":17741,"size_decoded":7362,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (17638)","md5":"572d66e85091711b6ee76609573a8364","sha1":"332031949d78a49e8a18611556253660574e47db","sha256":"5cbda29ea5096ac9404c59c77493a2f467d0eb4a27f16c750b61fc0d888dd716","sha512":"cf8394ab0dfca8d2e99f59626c037d06ca03c7a9db3458a8e6503a0ae4e9f4d94af376fcf61832095abe37915d049a6d20dcedc67d59dd268a48a512e543fad1","ssdeep":"384:f7LTpKyzqrGGpLZo12xhMFoFlm5dwi7SeigzrLL:XTppX12j2LD7SeH","tlshash":"e982a7cc32c3b496539395b1806f244bb23e5d8064ad98a0d669f1f43c3495d89bbefd","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T12:00:45.93545Z","times_seen":11254,"resource_available":true,"data":null}},"time_used":292,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":272,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/Zahra-Beauty-Final-Logo-01-1-1.png","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.666Z","timestamp":1789899740666,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/Zahra-Beauty-Final-Logo-01-1-1.png HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 07 Apr 2025 21:46:14 GMT\r\naccept-ranges: bytes\r\ncontent-length: 22957\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":22957,"size_decoded":23349,"mime_type":"image/png","magic":"PNG image data, 154 x 170, 8-bit/color RGBA, non-interlaced","md5":"1239a4fef10a1daae9af169aef59a8c8","sha1":"09c7e28fbec764fda1612ea179414c2fa3559117","sha256":"342140f83e2f897e7c4caee46acb0245a18fb6f18ce8de569a51c58a8694ff43","sha512":"e3ce2b9e6e4de858bbf6f778d1424436c5f19ec5a54d5c711763e2419567fbe6d3d9c3c9ffb933aaef487c7c1b21b8f7554954bc2510aa22482b3e3c5ad1d33a","ssdeep":"384:Gp2vGeEscWNmVy4QsraZKcB2Q1Ifb8t3xbCX20IKRUPp1XSNcrynJFmCqun5FMaO:zvXjcWNm8sraZ1BvKfbcBW//UPp1iR/K","tlshash":"07a2d16c5801982fc9495be27471945612b43f22193ff5b35c5059bfbb2b20ec43ba3a","first_seen":"2026-09-20T10:15:22.499613Z","last_seen":"2026-09-20T10:23:11.915293Z","times_seen":2,"resource_available":false,"data":null}},"time_used":556,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":447,"receive":109,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/Frame-36-1-scaled.webp","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.944Z","timestamp":1789899740944,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/Frame-36-1-scaled.webp HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: image/webp\r\nlast-modified: Mon, 07 Apr 2025 19:58:37 GMT\r\naccept-ranges: bytes\r\ncontent-length: 27722\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27722,"size_decoded":28115,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 2560x1104, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"89d7a5505a4ac3061a1110ad5c6e90a6","sha1":"744684070e8faf654b47caf11d5252f5a8be7c9d","sha256":"9412cf4dcc34cae910cccc75622de65bf97c63d68b526ebb759b7a738943b2bb","sha512":"0ca22c43b216e78f73f6ef2fd230aebee6e044c0d759036537c747d5fa0b3655b9d8b9e40553898bae075a5e4e17bca77e00f51b5f745786b99d3aec91b28574","ssdeep":"384:T5yVzOC73QLXlgQF0mpe/LcRipYJzzWW3FxTegA2DwpIizhqSex+RuwcC8wnsv:T5oOC73CXlt0mpe/mh3FfAW4RlcFwsv","tlshash":"f6c2bf8eb14a2702cdc745731ff4a5383d59b5aaaeaa433e5d386c4d9d0c18e459f0dc","first_seen":"2026-09-20T10:15:22.476071Z","last_seen":"2026-09-20T10:23:11.916745Z","times_seen":2,"resource_available":false,"data":null}},"time_used":268,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":140,"receive":128,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/build/header/header-layout-centered-menu.css?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.606Z","timestamp":1789899740606,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/build/header/header-layout-centered-menu.css?ver=16.1.3 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 18:57:42 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 341\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1642,"size_decoded":775,"mime_type":"text/css","magic":"ASCII text, with very long lines (1642), with no line terminators","md5":"863693402b4e5b9b0fa7479d164a18f7","sha1":"d1c7b2e6f3229d1cd0ff90c868647a9ae75bbd90","sha256":"d5df8c4f075fbd7660ecf370d9d2da500d023eac905e48a76df486aacbcc16ac","sha512":"e1b509e896c28f21f10f37077b66a301e79dea56bc2433eb80c6af95d8c6c132d45c2caf1b7277c757e1903bdfc4bb861d293833429b6b85877a0d15cf064a18","ssdeep":"","tlshash":"9731da326cc71564016325dcc4ca6f4a67a9b3510ebd1985b7488c3b4ef7aa6b0e4be8","first_seen":"2023-11-26T11:07:28Z","last_seen":"2026-09-20T10:23:11.917844Z","times_seen":1086,"resource_available":true,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/hoverintent.min.js?ver=1.9","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.638Z","timestamp":1789899740638,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/js/build/third-party/hoverintent.min.js?ver=1.9 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 07 Apr 2025 18:57:43 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 892\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2245,"size_decoded":1293,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (1933)","md5":"507093401cd1d74603963e9a93012460","sha1":"40920e71e0dc7b172c80ac5905f9a9c42aa8acf0","sha256":"86a156b80c4342d46aa6bfdf42944e34cd85f5935e38c20bd58445006ca12a96","sha512":"954aa6351d223570b9e8e22cf329c2020d114d0da46fc5d62109fbdab4de4f29fd14bf56fc7c831bb65609fd2120dd198990b3c47034d0ea5d1b1f3540e4dd1d","ssdeep":"","tlshash":"cf411e4d270924185bd79ba0603ff87ebb4e156ba50d09d1b3776a4c3ca6c29022b79d","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T12:00:46.01354Z","times_seen":7507,"resource_available":true,"data":null}},"time_used":253,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/jquery.fancybox.js?ver=3.3.9","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.639Z","timestamp":1789899740639,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/js/build/third-party/jquery.fancybox.js?ver=3.3.9 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 07 Apr 2025 18:57:43 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 20932\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":68855,"size_decoded":21335,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"7270c88429fb55fdfed258cd32beb804","sha1":"732d27a9a7b89cea06a51b8c048bcb21c12262e5","sha256":"3ce9be76f458848a316e79e59b1f08598f7bb71778871a34bd9c469772459728","sha512":"2bf6d1726e08b3d79e6f396dd19fd0894157dbb1d2662c79872784bfaf0b493faa4b7a6e9cd4d9b449e26a807b1235b35835b8aed27d4c8d376e454a8718c1e3","ssdeep":"1536:zUtGulsqqQzeFuouppK0WEJnsQrNz7M4HJ3t5oSKN1fQq58cTJ7PBTf:6GasqqQzeFuoubK0W2Nz7M4pd8qq58cH","tlshash":"0163f89fb650702582bb0594a30f520ed137711af10284fa78bdd4d55ae4fc922ebbfa","first_seen":"2023-07-19T23:18:28Z","last_seen":"2026-09-20T10:23:11.919477Z","times_seen":2880,"resource_available":true,"data":null}},"time_used":276,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":252,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/plugins/js_composer_salient/assets/js/dist/js_composer_front.min.js?ver=7.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.646Z","timestamp":1789899740646,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/plugins/js_composer_salient/assets/js/dist/js_composer_front.min.js?ver=7.1 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 07 Apr 2025 18:59:02 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 5915\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26583,"size_decoded":6317,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (745)","md5":"7493ac7b2815c1b0db6ec26a2080b625","sha1":"35b090889db267c357c08a2bd28f4a9fc199d796","sha256":"af6aad45dfea3dad21ae2d7d9b2b44e7ee84ec9b9df016489ec4f003edf1314f","sha512":"0eac8f30eafdf236ca0d8e96599ce6dae7a99eb4e48aeafbcb2e9dd0a239aa8aac7145ffcf32719e90e0d505c5bccc89f4eb6b367af49db3adfbca0c9983a9a3","ssdeep":"768:WKiitGHBpfOiaCKaUGia7tyIADu8vVeTUVEMm7BGBS:TtEJz5Zy/Du8vY3","tlshash":"65c2851e74b430a491773a36a93faa1871371437600e75103d4ddab82f7a82e527afed","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T11:19:35.607716Z","times_seen":2079,"resource_available":true,"data":null}},"time_used":356,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":352,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient-child/style.css?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.619Z","timestamp":1789899740619,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient-child/style.css?ver=16.1.3 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 18:58:29 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 169\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":304,"size_decoded":603,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"740b238eb30b761d0d3b8541932862ca","sha1":"6ebb71d4875d2f8b42bb011c26e2d0325ce328dd","sha256":"dc71f382e4e485c110a5bdc7763a35849ba5ecfd597a003e8e6d99e587fdb880","sha512":"99a63254843dc93820f28204efe6c4f082b76e867ce17b3a74d515153dc4a22901646416e4e105b43b1420a849ed581eaf5b171798f133ff5656c8141b355cca","ssdeep":"","tlshash":"b6e0cd8a5d17b273b3bd174891b5ae41d3a57334d9c35450f4460e094335166229ef5c","first_seen":"2023-04-17T09:04:38Z","last_seen":"2026-09-20T10:23:11.92116Z","times_seen":2421,"resource_available":true,"data":null}},"time_used":143,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":143,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/build/off-canvas/simple-dropdown.css?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.628Z","timestamp":1789899740628,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/build/off-canvas/simple-dropdown.css?ver=16.1.3 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 18:57:42 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1214\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6359,"size_decoded":1649,"mime_type":"text/css","magic":"ASCII text, with very long lines (6359), with no line terminators","md5":"6b8796dc749f892231e84108c2d6389a","sha1":"3b9c0217c36f071b472edb3a4dcc22c2d21360ce","sha256":"3f3ee36d10f4581f3812683fd9cf8f585ac4aa9d1ebf5599aa0a7affcd99327d","sha512":"6a421da801396ef9d3754bc14aaed2f91b02af180e90c2e356f0cac871c8f6eb080c92d55ad2809f3b01eb54667674bc4861477dff3db08462b742636bbf242d","ssdeep":"96:5TbPuMw6M56rWYFtXscv7lNZSoMsMEIH+36Yz87cC76zyYqYmxtH+WSsfQHG9fuo:0n5f1cvKH+36Yz87cC76zyZjcEMm","tlshash":"e4d1e110dae4a266202b5774ffd8ab11233c23a1ab6609cbf50e4c2f5f87b5950d35f9","first_seen":"2023-07-25T16:27:17Z","last_seen":"2026-09-20T10:23:11.921906Z","times_seen":143,"resource_available":true,"data":null}},"time_used":252,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":250,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/init.js?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.644Z","timestamp":1789899740644,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/js/build/init.js?ver=16.1.3 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 07 Apr 2025 18:57:42 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 78732\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":375431,"size_decoded":79135,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a0356157d149b7bf1cf2ec157ae56e32","sha1":"6b659af962163268f4faadf9e4cac107d32cd1c5","sha256":"d05732efd6c3c6ab81b8591dc5b0ea738487223630b9e72aaf55075616424c08","sha512":"872d3f07f04406c9c8728f6afdc28b3eaa206d20bb058a38bf9d99afea1452c90b8afa1751fe177485b0b50e07f92bd5b05e38295a60cfdc66c42643ec1c4ee7","ssdeep":"3072:nBEeoWyyu+qzb1ACPRpDp2AmtpNvgQ8Qp+J3262whGAzHDcHMHHfXhJe62tIbz9L:nF6ygCCPRpDpl5MAzHKMgI+u","tlshash":"7384f94ab610227652ff0792909f790522725c35cb024559b1bad4f90cbaedc32bfb7e","first_seen":"2024-01-05T05:20:58Z","last_seen":"2026-09-20T10:23:11.922668Z","times_seen":329,"resource_available":true,"data":null}},"time_used":354,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":291,"receive":63,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/Group-140944.png","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.663Z","timestamp":1789899740663,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/Group-140944.png HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 07 Apr 2025 19:33:47 GMT\r\naccept-ranges: bytes\r\ncontent-length: 22835\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22835,"size_decoded":23227,"mime_type":"image/png","magic":"PNG image data, 168 x 64, 8-bit/color RGBA, non-interlaced","md5":"c0941f5d592c6752ada2b5dddba1fde8","sha1":"a7555c51b432df970ec5f933dcd9062ef973d213","sha256":"8d871b95b7feb3610e935fbfa1165f55b59f5c8daa3f5fcf86d03ac24e64d8c7","sha512":"4e0bd14394146455cdb4e6b76990f7fe0f3f9801aa5757401048329ebe7588b3101af770a40facc83ac2cf5d25dfb1dbebaa5fb9c1360334540e97cd48dcb89b","ssdeep":"384:XCSi8UqD6Wp7+e0cfRfX5qyzWW2CgRMS5a2lksKAaKff6Xv/eGv1U:3NUbWpqe3ZfJqqbQ5a2lojXHeG+","tlshash":"62a2e1dd2f9eb9feb4f01541e210c0b2568384919e2a1b3e14bc43175aa1ba46ddb9cd","first_seen":"2026-09-20T10:15:22.524069Z","last_seen":"2026-09-20T10:23:11.923446Z","times_seen":2,"resource_available":false,"data":null}},"time_used":572,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":387,"receive":185,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/Frame-2095585852-scaled-e1744063088768.webp","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.950Z","timestamp":1789899740950,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/Frame-2095585852-scaled-e1744063088768.webp HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 27 Sep 2026 10:22:21 GMT\r\ncontent-type: image/webp\r\nlast-modified: Mon, 07 Apr 2025 21:58:08 GMT\r\naccept-ranges: bytes\r\ncontent-length: 12868\r\ndate: Sun, 20 Sep 2026 10:22:21 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12868,"size_decoded":13261,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 2560x1233, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f5027945e53bd48dc43c81a33c1d05e6","sha1":"9fd1c8ae88b06f744bbf6908c7376fde0b77b606","sha256":"b9097ef3179250c6f5b17abc9ace41d12eccf2c85d26e4c913f12ea4038468bb","sha512":"75febe2a72cb80ea26f33b3243daa65144791bc5820c8fe663320d7e172e056bf326a7274fb9298d7daa90aacb9ad603fbab5494ec4f68a66c6f6e255a93bc64","ssdeep":"384:opRdMdLrn5d1G7KYOFnvumk39+M/33deMAz:opUL87KYAvNM/njAz","tlshash":"0142af6f61e48838c86d04b5745fa880e8ce7145eb3484e8c7b40568dd6defef93e419","first_seen":"2026-09-20T10:15:22.481585Z","last_seen":"2026-09-20T10:23:11.924315Z","times_seen":2,"resource_available":false,"data":null}},"time_used":258,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":116,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/cropped-Zahra-Beauty-Final-Logo-01-1-1-192x192.png","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:21.260Z","timestamp":1789899741260,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/cropped-Zahra-Beauty-Final-Logo-01-1-1-192x192.png HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:21 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 07 Apr 2025 21:55:24 GMT\r\naccept-ranges: bytes\r\ncontent-length: 31289\r\ndate: Sun, 20 Sep 2026 10:22:21 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31289,"size_decoded":31681,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced","md5":"4a74248ccf8ed3f7c0e56fb7835d1a99","sha1":"46963c5fb328939b5f46fadfa12f7c4f84605666","sha256":"3fb4a1580a1673eca03cd3659391e3a5145ca5d1b5e9464d68bf952f5f0ced4b","sha512":"f3d916ee87fae7103d6be40dedfcf1517e5370504ecc711e49215d0a908851a98b63d7823fc1b18f0535bfa89c9bd113c7ba71315210e4ad15b3d219d1e5fe93","ssdeep":"768:yjI9zdujBo7fuslLUx5H8/ztfGhe8Z/Dz74L:yYkj+7fHUx5HyoFZj6","tlshash":"3de2f2c60b55f543811eeb7768337c46ca8cf3ba3f174a55e43458236901b296f3954b","first_seen":"2026-09-20T10:15:22.534243Z","last_seen":"2026-09-20T10:23:11.925116Z","times_seen":2,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":112,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.622Z","timestamp":1789899740622,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 28 Aug 2023 21:14:24 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 29744\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":87553,"size_decoded":30147,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-09-20T13:41:49.22254Z","times_seen":1062945,"resource_available":true,"data":null}},"time_used":252,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":161,"receive":91,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.623Z","timestamp":1789899740623,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Fri, 09 Jun 2023 09:49:24 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4678\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13577,"size_decoded":5080,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (13479)","md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-09-20T13:43:23.71035Z","times_seen":971658,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":96,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/Frame-2095585850-scaled.webp","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.948Z","timestamp":1789899740948,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/Frame-2095585850-scaled.webp HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 27 Sep 2026 10:22:21 GMT\r\ncontent-type: image/webp\r\nlast-modified: Mon, 07 Apr 2025 20:40:27 GMT\r\naccept-ranges: bytes\r\ncontent-length: 5144\r\ndate: Sun, 20 Sep 2026 10:22:21 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5144,"size_decoded":5536,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 2560x936, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"08505cbcbf28181af1ecf47d76db4293","sha1":"8dad8342640d42a5614ca1f4174fd8ae550d4f0f","sha256":"54ab87f4993d6335decc0dec3d3dc51336f03c143b836a4faf1b0c4723007d7b","sha512":"6991bc561a29187e2624a7494ccfada5064c6efbcc22232514a907dbaa0a5765952338873f77a5e1324eaa4a4e60d6b2e13d379d344c19ca7a3e7f3b06b32152","ssdeep":"48:O1BfLBfLDfLLfLe3fLD8kfLPRvfLwnfLmfLEZfLofLBfLvBfLBfLBfLBfLBfLBfD:OVomwsS","tlshash":"13b14db594599404da57e5f97f0372b36894cc724bdd3f7204eaf0a58bb60f43ba1880","first_seen":"2026-09-20T10:15:22.486718Z","last_seen":"2026-09-20T10:23:11.927354Z","times_seen":2,"resource_available":false,"data":null}},"time_used":259,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":113,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/plugins/salient-core/js/third-party/touchswipe.min.js?ver=1.0","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.645Z","timestamp":1789899740645,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/plugins/salient-core/js/third-party/touchswipe.min.js?ver=1.0 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 07 Apr 2025 18:58:58 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 3148\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9375,"size_decoded":3550,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (9357)","md5":"20f13f992fd02ead68fb17893467a8b5","sha1":"8b37d46d93eb907cf0f8f95c3220eda45387389e","sha256":"cb225cbe89436bb47d3b4486cd9cee63db751cdaf60409f496253ca8be549dae","sha512":"cbcbd38dc2176f280c94d561fabb45f68fde3d0417c9d60100ad9c8360828501be5615fdc3acdbd3d3722c3a6327ca8b4e21590963850ae1f29c375dabab9e62","ssdeep":"192:KKirvjKPsO/kAvi8uErTNi7OasUrxq0G/2X8EpW7QYovE3aCn9h:KtesO/kAOErTNiSasUNqpo8EpW7QYosp","tlshash":"661275c67622b217a6d82276d31f0b57661e6c63192ac571f0b2ec50fb340b4627fbd8","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T12:00:46.00689Z","times_seen":7524,"resource_available":true,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":352,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/Zahra-Beauty-Final-Logo-01-1.png","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.662Z","timestamp":1789899740662,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/Zahra-Beauty-Final-Logo-01-1.png HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 07 Apr 2025 19:05:56 GMT\r\naccept-ranges: bytes\r\ncontent-length: 11072\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":11072,"size_decoded":11464,"mime_type":"image/png","magic":"PNG image data, 85 x 93, 8-bit/color RGBA, non-interlaced","md5":"e9c5d4d1a0454653fcfd4bc25c4d2afd","sha1":"e1649fcd61575eeb84803bf0f70aabfc0dd78d5b","sha256":"2a8e957bdfc796f84b27631cb3410b0f0bea4c84571100f4dda1b7de571e883a","sha512":"e2848e7d7ae79839f8861bad5e4fc80aa350e367ee9d8bc6f78efa07066aa2996b1efce7e922a0e9c1105ca18e4a0222d0e3d0fd22ae2d6ea131a1de2d93a33f","ssdeep":"192:KS/NcHWM194DfHEXkojSlhb7XZu4SeSUZhwoPX04k5Y2Evtp/Y4afi7ou:F/eN7Aazj4pJu4jSUDwovN9gNsou","tlshash":"8032d1c2d315cd18b20ccdfb58d294cc1df3d62804a9b1a81ea5e9122a87b77c94c0dc","first_seen":"2026-09-20T10:15:22.529782Z","last_seen":"2026-09-20T10:23:11.92904Z","times_seen":2,"resource_available":false,"data":null}},"time_used":568,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":335,"receive":233,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/waterfall/v8/MCoRzAfo293fACdFKcwo3bv9.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.989Z","timestamp":1789899740989,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/waterfall/v8/MCoRzAfo293fACdFKcwo3bv9.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://zahrabeauty.ca\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 36640\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 18 Sep 2026 12:49:02 GMT\r\nexpires: Sat, 18 Sep 2027 12:49:02 GMT\r\ncache-control: public, max-age=31536000\r\nage: 163999\r\nlast-modified: Thu, 04 Sep 2025 17:16:11 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":36640,"size_decoded":37453,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 36640, version 1.0","md5":"0ab6e381a66581ae1c0b796116402365","sha1":"87a277e0d30f7395624d82a23bcf309a0ec9d884","sha256":"afea2524fb49835240032bdf56f2aad8e122669661f13b12e332eb101db69692","sha512":"d8bce3e8b48a4c1173af2474209a03657faf6d00d5a4de8661b65494a3bdf85bd3e7dc469962a8674cab48add4e334e45d388473d466505157132e31b0a250ea","ssdeep":"768:YgtfZbZALh0rOh8VBoOk4SvNtJkdT8t2GObG8yWaGzqYeNVYW3iaKtpYRjjyl:RxFhrOcBivNtJ+T8tDObG8tazRVYWGLn","tlshash":"59f2f01d7852a5f8792985bfcf7a8ee0b1256c9ee75140d718884ee878e301472dcab3","first_seen":"2025-07-05T16:18:06.192367Z","last_seen":"2026-09-20T10:23:11.929984Z","times_seen":42,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":23,"dns":1,"connect":0,"send":0,"wait":45,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/cropped-Zahra-Beauty-Final-Logo-01-1-1-32x32.png","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:21.261Z","timestamp":1789899741261,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/cropped-Zahra-Beauty-Final-Logo-01-1-1-32x32.png HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:21 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 07 Apr 2025 21:55:24 GMT\r\naccept-ranges: bytes\r\ncontent-length: 2136\r\ndate: Sun, 20 Sep 2026 10:22:21 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2136,"size_decoded":2527,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"0a1eab00373e2f5e6cd7910b8f434087","sha1":"8b89ca010286304f1418f7b4fc973d2b85cd931a","sha256":"e76f9234cfb2880f3b205a1aac6079f26451e80737336a4fde63cd15ee47bf3c","sha512":"aa9dee1d74e32131d8ca0e546f4765c58daf86225e1a2ddc06ea309b6973a4dd25642c14678b8266cd926e600e4e73c4286f856f0bfb449e5a7e23f3da83a10a","ssdeep":"","tlshash":"ae413cf20275411cea5b3d292f22448e6e6206f17655fc63d1df90e15b62b3bdad8228","first_seen":"2026-09-20T10:15:22.482773Z","last_seen":"2026-09-20T10:23:11.930622Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/jquery.easing.min.js?ver=1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.631Z","timestamp":1789899740631,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/js/build/third-party/jquery.easing.min.js?ver=1.3 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 07 Apr 2025 18:57:43 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 777\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2392,"size_decoded":1178,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (2320)","md5":"56ba0cdb72b1b00226a21fe08251054a","sha1":"82bef20f71eb674c7d1d63242c80afbc1e6d8274","sha256":"15a71d32b340bf3641581ac5b4f37887b9cb3981477d5886ec5849749c8a36e7","sha512":"6f33bbc08a61ff3fbfd3533f16355f7c804f2c151496da3ff0bc14939e7baa44ca7da56bc93fb555afd59e1ace12beb8deccf3e3fa208ae66d66b8d4f40ba718","ssdeep":"","tlshash":"984129c9b9c3b75e935275e0162f200bb76e6ea000ed2530c66178aa7d3431d9d3bacd","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T11:19:35.710868Z","times_seen":7352,"resource_available":true,"data":null}},"time_used":249,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":249,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/waypoints.js?ver=4.0.2","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.635Z","timestamp":1789899740635,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/js/build/third-party/waypoints.js?ver=4.0.2 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 07 Apr 2025 18:57:43 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 2520\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8999,"size_decoded":2922,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (8999), with no line terminators","md5":"900bad1dbd9b131a99f31703a66340f3","sha1":"ca580144be55dabae951a984529a5250d279b129","sha256":"3c9eb9bb1076bbb11745885964334df870bf7eb621daa5e7475a9a5cf4b2e424","sha512":"d0cf2c673096b76e4018a4a7f2b900570ba0094116e69ba4528b96e27f5339cd20a1ccd68adbba0f1e1d854cff08a7ea10605d75d04ac5be3e2f8cd1da04a552","ssdeep":"192:NKasXzHD9D5/6J8bvctcfqqTapzikrCeexsvfip9Y8pY7pZpz9n+HyQ8m8Fwmtre:wjzHD9Dpm8L2cfqqTapOeexsvfip9Yne","tlshash":"9802748d750134221b9f91b9e91f434ab337582ca40580bdb0d4d4ee28f252db76bfba","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T11:19:35.648058Z","times_seen":6505,"resource_available":true,"data":null}},"time_used":253,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":250,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/useanyfont/uaf.css?ver=1744053166","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.416Z","timestamp":1789899740416,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/useanyfont/uaf.css?ver=1744053166 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 19:12:46 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 155\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":336,"size_decoded":647,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"92900f4bf69dd4abe37c15d8c6ab1f73","sha1":"26a37c1de90714012b19f2ab897787a3d61e493a","sha256":"d0786ffc2554d3da1698562d66a1e1a3cfeb0a830df74e5cf2ea1a14aead8864","sha512":"7329f1cc85efcced86a204da2a6f1a6db51ba406da6f6618db7ec3128e4093e865c2837f40d3432e91b7c10b132aaf4596e172b52ac22881250847004f21fbbc","ssdeep":"","tlshash":"1ae02652348ea101e624bd0225751f276d3ce03a02104bd93e1814cc8ccb4000390b3c","first_seen":"2026-09-20T10:15:22.518437Z","last_seen":"2026-09-20T10:23:11.93272Z","times_seen":2,"resource_available":true,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":112,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/build/responsive.css?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.612Z","timestamp":1789899740612,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/build/responsive.css?ver=16.1.3 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 18:57:41 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 6928\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":39335,"size_decoded":7363,"mime_type":"text/css","magic":"ASCII text, with very long lines (39335), with no line terminators","md5":"1862dbf0180f8038caef90192172eabe","sha1":"95081a8989fa138458fda054a3d9fd87e1a97804","sha256":"129d5a14516908ddabff7b729edfbe4cdc9b09502381a864549594848d34171e","sha512":"29ed9b8a31a322d898a485cbe67f952d6019b67b92e0f85f28ced4adbb3b1c12e3bbae1925cee317cc23efdf0a4520595d007a16d85e7ad02f6b6535c5f40197","ssdeep":"384:IhrW8KpdwYSMGBcyVwu3/AQFPwavj3gEcgFK7B2vmN8Cagg:58nMHCVASPH8ab","tlshash":"7903c666f98c2a3e12731b1af5cc79342e78712197932ae7f884841f47ca3c670652ed","first_seen":"2024-01-05T05:20:59Z","last_seen":"2026-09-20T10:23:11.933646Z","times_seen":345,"resource_available":true,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":112,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/salient-dynamic-styles.css?ver=53809","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.618Z","timestamp":1789899740618,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/salient-dynamic-styles.css?ver=53809 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 08 Apr 2025 23:17:05 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 21351\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":172540,"size_decoded":21787,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"5a04f45c41cc15228f8eed8ea7cba4b5","sha1":"7d70bad5cd7d9aea85302d4f374740c06fc8e320","sha256":"f89a3166c157e22a0d3faf946038e0ed7e635b99db94fe389e4c56f0bffaf122","sha512":"07e92f7cb98f144d19f3974b5974ea0066d905d2952f87786e9b3c7c04da6a2c1577550227d5208e16f5dd94ab6b0c2304fc660074da414d5b97ed3afbb7763f","ssdeep":"1536:XLlnyhEvdOfxwIhvplfpXjXo30e7mlaseqtml/rqldsCx3oEDwCX+:o55Ve7mlaseqtml/rqldsCZDwP","tlshash":"ebf3c86afd8d1b2a67330768e4cdbb603f14b082e5951694f9ac846f51ca0c6b1173ef","first_seen":"2026-09-20T10:15:22.48499Z","last_seen":"2026-09-20T10:23:11.934488Z","times_seen":2,"resource_available":true,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":144,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/font-awesome-legacy.min.css?ver=4.7.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.418Z","timestamp":1789899740418,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/font-awesome-legacy.min.css?ver=4.7.1 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 18:57:37 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 9342\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":49935,"size_decoded":9777,"mime_type":"text/css","magic":"ASCII text, with very long lines (30343)","md5":"57302b6cec774f116a26a5e1690e7f91","sha1":"069d18f167dc68937186d69caa58410b5820721d","sha256":"7adb967745932b25c31da3ef4a92f2b8e166926a7a8476fe8c8c58fc84b95fa3","sha512":"e51c5b6b302d87540e94436c016dab3b8981248e591d1fac8ca016e3b9cd234e2164fc55b651ac03dff254e5a2482777d8e17f906c65fa238187a1a1f4e3a317","ssdeep":"768:Gza+79Vdo9IKlr+Klk3Yi+fwYUf2l8yQ/e9vf:Gza2o2KlrniSUf2l7f9vf","tlshash":"092368f4e90d00d66331c48bff817368aaa5f73dc98a4c56f10f690caee225516c5bb9","first_seen":"2023-04-09T21:03:48Z","last_seen":"2026-09-20T12:00:46.002462Z","times_seen":4359,"resource_available":true,"data":null}},"time_used":141,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/build/grid-system.css?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.419Z","timestamp":1789899740419,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/build/grid-system.css?ver=16.1.3 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 18:57:41 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 2529\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":22079,"size_decoded":2964,"mime_type":"text/css","magic":"ASCII text, with very long lines (22079), with no line terminators","md5":"d908a3a6eebda928824c97bf18f423d2","sha1":"75dd1c37b1bf6cf9e4054cfe19c1121a7c7aa7f2","sha256":"20bf1273c65dd45f65e5bccf1976ab54e77c61fbd5049bd2f636ee486158dad5","sha512":"096404df16293f43bdff8db30a0eee0d76625724541153b0cacfdd0dc2cfebd52ab9d78c346feb80e6d1e8cd966b7a0cf32ed1ea81f1e1a496db2d2ca687bcd8","ssdeep":"96:z6m+PaU0SkukZdjjqsCkskPDJoIRnK6RmMJiUdAIgFZFMqUlAUZ2nxHMfAATAvNg:ODJM3inxOVbKXltutfOepNrGax8W3","tlshash":"67a28c0a5c642e75183bca1670b16808dc6b78023772efbff29decc44e9a57f1825667","first_seen":"2023-11-16T19:52:37Z","last_seen":"2026-09-20T10:23:11.936297Z","times_seen":1266,"resource_available":true,"data":null}},"time_used":139,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/build/skin-material.css?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.614Z","timestamp":1789899740614,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/build/skin-material.css?ver=16.1.3 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 18:57:41 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 8600\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":56045,"size_decoded":9035,"mime_type":"text/css","magic":"ASCII text, with very long lines (56045), with no line terminators","md5":"f6577e795b066c9ed763e9d325b1c3ac","sha1":"5ae9a2ba3eae806b123f8347600bd394ae311276","sha256":"605a04e010dedad9eab40cf8ab2f99dbd41ae3c2bc0116aae4a61353b9c1c12d","sha512":"1b25371ee6551f6c5b473730ec031a101eb6603bc4bcb4e0b5c3dc15d79e6d713e79bfe2476d082b0909b16cea3b14ee38edd372b20b26682a73583b6e983758","ssdeep":"384:BveIMkY9GYBTznz1np5Y2Y8iLNui5/LAkVNsoTTZJLx/iUjaWtiNjePkAdmAsP5H:MnPStX0kVNfJsjePkAdmAsP5E+s98","tlshash":"1f43b985f98403dd23634255d8c4a3503e156187eb373ae4f59b5aaf83ce98e212d3ee","first_seen":"2023-11-16T19:52:38Z","last_seen":"2026-09-20T10:23:11.937106Z","times_seen":366,"resource_available":true,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":133,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/priority.js?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.633Z","timestamp":1789899740633,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/js/build/priority.js?ver=16.1.3 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 07 Apr 2025 18:57:42 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 698\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1922,"size_decoded":1099,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (1922), with no line terminators","md5":"b08178f9f045f881029f695e4b939291","sha1":"e62866a6042f4f2a0ca8bf8621f550803ed0f006","sha256":"2ff736ab797eedc5190bf7dae8ff0bd0dcd546d7cce417ed909a608ce385acd8","sha512":"c4e70efd0652460e72cee7c7e68244d24b3f8a3ba5f8b6a322c71b4cf55b022d454b19de8092fff8f3c47e1db676b4b9b8ebf8a6dd962739922d37dbb0c0252e","ssdeep":"","tlshash":"eb4131723100bd7156bf2d87fa8a7f4a229096510a155100f31c483f29e4ee7fdbb7a5","first_seen":"2024-01-05T05:20:59Z","last_seen":"2026-09-20T10:23:11.937797Z","times_seen":5174,"resource_available":true,"data":null}},"time_used":250,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":249,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/transit.min.js?ver=0.9.9","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.634Z","timestamp":1789899740634,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/js/build/third-party/transit.min.js?ver=0.9.9 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 07 Apr 2025 18:57:43 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 2572\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7416,"size_decoded":2974,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (7281)","md5":"8e9392ec75b6ef18ba671a0a4432d1b1","sha1":"7e7a63444fb918382d51bd2f7bd3757c0434ff10","sha256":"fdcb39eec676f0d52a9647156d6e1c5e0668ebdbb1060cb8ff89d5b4ab4695e8","sha512":"5e3b713b57787ff0093a86b7b91180c7eb878cd652080258fd094ce4f978881795126671ee9ab0bc782310d8aa2ff83af6733cb0e4fa6a0a57fe611062275890","ssdeep":"96:PEcg7lrL7LMgkubetbEL/Q0O3fWt2GANOr+FDVq26A00NmSvzuzGyXPn1BBLt8:Pi7lrPVSbV5y+FUVb4","tlshash":"8ee194557a90b22c02bb613081df1846203dde6737a9f55af321e4a7acb540d835bfbe","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T12:00:45.940063Z","times_seen":8050,"resource_available":true,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":249,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/Frame-1171274923-scaled.webp","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.946Z","timestamp":1789899740946,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/Frame-1171274923-scaled.webp HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 27 Sep 2026 10:22:21 GMT\r\ncontent-type: image/webp\r\nlast-modified: Mon, 07 Apr 2025 20:23:24 GMT\r\naccept-ranges: bytes\r\ncontent-length: 15832\r\ndate: Sun, 20 Sep 2026 10:22:21 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15832,"size_decoded":16225,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9cabdcefcf5b46857b96d345262809fd","sha1":"206283a2c00a5accecdd32c07e45afcc14633203","sha256":"12ba55b2afc9e5c0d306be9fd4708b42027c895af4b94cf400040826b3156213","sha512":"9ae3cf5753752339756b0ccf7862a3aaf62e50d11e7cda4fcfb62eae2f5470bb25bab540db124811d9b596510a2c5e1fdfaec347151e9a5b3ea503814e3bc3d0","ssdeep":"192:x5Nn555555555555555555555Ivdw96MjrgN9r7qVNDRsggqBjvLBmWiCG3VbFbR:ZoMjI9rqRRs6jYWI3nbMzK1","tlshash":"41622a60c6878a11d347e9fa1454709cf5ab3e09b43e292b837e77b2b6ca333124d59c","first_seen":"2026-09-20T10:15:22.530981Z","last_seen":"2026-09-20T10:23:11.939051Z","times_seen":2,"resource_available":false,"data":null}},"time_used":261,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":167,"receive":94,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-20T10:22:19.248Z","timestamp":1789899739248,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-powered-by: PHP/8.2.33\r\ncontent-type: text/html; charset=UTF-8\r\nlink: \u003chttps://zahrabeauty.ca/wp-json/\u003e; rel=\"https://api.w.org/\", \u003chttps://zahrabeauty.ca/wp-json/wp/v2/pages/16\u003e; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\", \u003chttps://zahrabeauty.ca/\u003e; rel=shortlink\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"imagesLoaded:4.1.4","description":"jQuery plugin for seeing if the images are loaded.","website":"https://imagesloaded.desandro.com/","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"WordPress:7.1.1","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP:8.2.33","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"wpBakery","description":"WPBakery is a drag and drop visual page builder plugin for WordPress.","website":"https://wpbakery.com","common_platform_enumeration":"","icon":"wpBakery.svg","categories":["Page builders","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":120000,"size_decoded":19627,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (28310), with CRLF, LF line terminators","md5":"39cfe597948d474c26fc1c3cbdfa52a6","sha1":"fa8d759d35392af943d01e1c826480623afb6bd0","sha256":"afb73b554d2b60b5b57b09ab4cc9358beb3610d74426eb11d8eb8b8aec792557","sha512":"85e7754ef0ecae4750393c2d7da96cb71a460c6baa89f9c58f2235140c8e474b50e66d0ab17e31be5b8b9370a92df73ebccdd1d33ec138b115bb45c19b79f0b6","ssdeep":"3072:N5TCsCVC8xbw3STfrowsxZf3dEs8lS2LkntH/kt86hQGSVQGSI/o3o2ocoElIQ1O:YyZf3OFL/mkDm3OAt6c","tlshash":"89c3a4737e50183a112b03d5e46aaa58fa62fb02cb0b5ad8b1adc1745fc5df23d3664c","first_seen":"2026-09-20T10:23:11.939796Z","last_seen":"2026-09-20T10:23:11.939796Z","times_seen":1,"resource_available":true,"data":null}},"time_used":978,"timings":{"blocked":0,"dns":143,"connect":111,"send":0,"wait":598,"receive":0,"ssl":126},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/build/plugins/flickity.css?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.613Z","timestamp":1789899740613,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/build/plugins/flickity.css?ver=16.1.3 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 18:57:42 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4782\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39715,"size_decoded":5217,"mime_type":"text/css","magic":"ASCII text, with very long lines (39715), with no line terminators","md5":"83dfb898b1919863f5919c2bf920ba80","sha1":"fd913080ea79d642691dea69134ab7b453a9082b","sha256":"f6b545a25cd38440f5f8615abb7dd83848b4f78f0b604372984991054ddcf8c5","sha512":"60a257def6f18c52d1a74b861ca527b9840ab3c50d1427fff285e87010fc698c812fbd417a3d38fd382ad1a08175fb63e14843a6f4d82714063ce7918ad05ac3","ssdeep":"384:xbNGjxG1glb+CWp/Wix9nNxoAHqTVkEVpEgJPY70:xbwjxG1glb+CWp/Wix9nAAMkEnJPY70","tlshash":"03030e5d2cac3e08183f77045cd4e154711af822a66209e6f2976c6fa5ceec970af5ce","first_seen":"2023-12-29T06:39:54Z","last_seen":"2026-09-20T10:23:11.941044Z","times_seen":133,"resource_available":true,"data":null}},"time_used":116,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/build/plugins/jquery.fancybox.css?ver=3.3.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.626Z","timestamp":1789899740626,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/build/plugins/jquery.fancybox.css?ver=3.3.1 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 18:57:42 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 3145\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13897,"size_decoded":3580,"mime_type":"text/css","magic":"ASCII text, with very long lines (13897), with no line terminators","md5":"7826eeb04a5f0314397db8798ec77538","sha1":"929db98b4d4982545819eac6b4063e54ed74ad50","sha256":"e29cbf382ac3c029b21249a8b53acb0985b4b326677c46b06daddafdee5ad8a0","sha512":"5706d4137245be7534b940af3a5f9f9c00a6c9c4f10bca5d584fc5aa20c86dd722e2a6dc685c9c6001277dbccf930f236d2fec8dea3fac0c688c225a59b1395b","ssdeep":"192:BJ6DcJ566s6kC/wEvH3etrWc/p2/PgNgUKJwu8LP7X:BJKQJl/wEvXujx2/PbN4LP7X","tlshash":"fd526073a140312c917bcd22c78fa94ce2369445a62227ffe95cfd64c7c67e412ea6c6","first_seen":"2023-11-16T19:52:37Z","last_seen":"2026-09-20T10:23:11.9419Z","times_seen":3516,"resource_available":true,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":219,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/useanyfont/5932IvyOra-Display.woff2","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.990Z","timestamp":1789899740990,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/useanyfont/5932IvyOra-Display.woff2 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/wp-content/uploads/useanyfont/uaf.css?ver=1744053166\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: font/woff2\r\nlast-modified: Mon, 07 Apr 2025 19:12:46 GMT\r\naccept-ranges: bytes\r\ncontent-length: 60860\r\ndate: Sun, 20 Sep 2026 10:22:21 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":60860,"size_decoded":61174,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 60860, version 1.0","md5":"1b5e9dd8644544254f450bb38a5776b2","sha1":"ae143a3701fe729cd7a17c19a64c810eaa01eb47","sha256":"9350cc35ec72bd92cdb495b39a699131caf7d4a3d565e708147d13e69b70c5bc","sha512":"80295e42841e8ea1e6dea7b594342b0203850b48d5d594e99d8738a2812d511a5ec333c603c67585b5544c082c3dc090aa5907968b213febf10d3eb3826fb1ea","ssdeep":"1536:11YBetMFreM4f7QxssXL2LN8t5MXbQ1gHi:11+iFTissXL2LN8t5o7Hi","tlshash":"085312ade94cdb40900b3c4f95d846d56e283dbe16a1d8fe44379b4b2023cf983a55fa","first_seen":"2026-01-25T20:36:00.95204Z","last_seen":"2026-09-20T10:23:11.94275Z","times_seen":5,"resource_available":false,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/build/elements/element-wpb-column-border.css?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.608Z","timestamp":1789899740608,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/build/elements/element-wpb-column-border.css?ver=16.1.3 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 18:57:42 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1173\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":21634,"size_decoded":1608,"mime_type":"text/css","magic":"ASCII text, with very long lines (21634), with no line terminators","md5":"f20eec2c6c5af8c1c22526ce009af6f3","sha1":"7a7b17625f6c08bc1a2216349cfb554f0028256c","sha256":"b1cc947266633e87d8ddd088b529ed80850e0bbc2570783af281edee435f0366","sha512":"f57d8e946db19c59df1cdf4957d515b5216ab4b471e963a0c3289427ec2c56a89860f62a9f309c435b916e4ddea9e046ad22e37debd0f0f040221aa61dc93c2a","ssdeep":"192:kXNxQjLb+GQKsKpKlKzTmeD/swxR8073Rc1c5pU8sY9C2erbcUhZgKSnfYY9NdcN:OnCK+K2pg","tlshash":"55a270b63c182a7ce1e7c311768d4ce8981b571a6346a6d8f016f5c308d82eb7e359ce","first_seen":"2023-04-13T11:38:32Z","last_seen":"2026-09-20T10:23:11.943381Z","times_seen":1596,"resource_available":true,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/envato-labs-image-edit-63-1.webp","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.630Z","timestamp":1789899740630,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/envato-labs-image-edit-63-1.webp HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: image/webp\r\nlast-modified: Mon, 07 Apr 2025 19:26:45 GMT\r\naccept-ranges: bytes\r\ncontent-length: 136604\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":136604,"size_decoded":136998,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e6d6302ac5f9cf3cb889ee2b5fe58c99","sha1":"a5700d0e8d4f77d3a571ecf699a4c95c198ba3b9","sha256":"a0d966606cee80301089543d23b60f042946b4d532551cdc2472ae58ca802673","sha512":"7326dd22107c9462eb4bf6c2b4b8626efec45f75796a948a67c34f3045868ace1037e2ee440c9b39fc10a694a07a8f90e0d3679452ec024a42f0e8ec6944c8df","ssdeep":"3072:dUTPgejxvcLkPL2b4IxdThVdCbQyXW8v6DEQ50EaRJDS/L1rh:dUTYU2y28IxdNP8Qk6DEQ5baR6L1rh","tlshash":"5cd312f94b476a5ed88d763da0635761f1ce94130e6942fa016f845e8b31ce8b8035ef","first_seen":"2026-09-20T10:15:22.508392Z","last_seen":"2026-09-20T10:23:11.943968Z","times_seen":2,"resource_available":false,"data":null}},"time_used":483,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":433,"receive":50,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/flickity.js?ver=2.3.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.641Z","timestamp":1789899740641,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/js/build/third-party/flickity.js?ver=2.3.1 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 07 Apr 2025 18:57:43 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 13483\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":55498,"size_decoded":13886,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (55498), with no line terminators","md5":"8bef3766446b7967077c629d96d146d0","sha1":"e7104c7ad2c7286eaab232476b6c75588877e1e1","sha256":"25cacb6853bc8fc8141a59af840cabd5b41c9bbce1e8accc4c19783949d3d5f6","sha512":"80579356ae23a201d0c808512ec36ff02dfdc7770ef065ee7f2450aeb55255fb3474eb688bf90e63ab98940656c14ecca3783a41e699e02c865471d80a10324a","ssdeep":"1536:DxD9oOEJ3FavYdgxV6sXUlniAvJE3J12/tUDP8tDcl3far5hEA9+rA+/:DEOWrO3JR1Ug","tlshash":"2a43764eb2413936418fb1a6621f460fb2b364ad140180acf5a9ecda5dfcc8d647bf79","first_seen":"2023-08-05T16:35:32Z","last_seen":"2026-09-20T10:23:11.944721Z","times_seen":903,"resource_available":true,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":289,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/26.png","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.665Z","timestamp":1789899740665,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/26.png HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 07 Apr 2025 19:34:56 GMT\r\naccept-ranges: bytes\r\ncontent-length: 483\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":483,"size_decoded":873,"mime_type":"image/png","magic":"PNG image data, 79 x 12, 8-bit/color RGBA, non-interlaced","md5":"da99b7a183dbc99b996a6f8938e9d0d7","sha1":"340b46bd604f11dbaf3099e3475b63737956754b","sha256":"c00541133fd7dbd76c5ae55ce71501108700f286dcbcba57da6d7e7974eb80e6","sha512":"38627aa397e6f6e44d35463d58d49f54fb63e970496434451a896b6a8586a620570bd275b8e81a0ccdd3957c78dacf0dd6a583109b243eb381665d6acd27f726","ssdeep":"","tlshash":"19f054e7af346cfdca5c17f48a0ad851a6f7372a0121cce8f369610761890386607774","first_seen":"2026-09-20T10:15:22.489144Z","last_seen":"2026-09-20T10:23:11.945332Z","times_seen":2,"resource_available":false,"data":null}},"time_used":447,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":447,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Open+Sans%3A300%2C400%2C600%2C700\u0026subset=latin%2Clatin-ext","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.610Z","timestamp":1789899740610,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:15 GMT","end":"Fri, 27 Nov 2026 08:06:14 GMT"},"fingerprint":{"sha1":"4A:94:E8:7C:D6:24:98:F0:09:11:DC:AA:71:9C:1B:6F:0E:37:D6:F9","sha256":"27:EB:1A:85:AA:03:02:5C:92:96:B5:9A:18:1B:65:94:2D:6C:B8:A3:56:3D:E9:F8:5F:E3:62:83:5C:A8:C0:59"}}},"request":{"raw":"GET /css?family=Open+Sans%3A300%2C400%2C600%2C700\u0026subset=latin%2Clatin-ext HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 20 Sep 2026 10:22:20 GMT\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23176,"size_decoded":2503,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"49148aa6aa83030c8107b048340b6d45","sha1":"0120fa4085b32b021b14aeae199e5dfade9bbf78","sha256":"c9232eb823d220300177aba31f7efd6e78e0ccdef46558336f8ede5a6efbfdc4","sha512":"2e5514ec03270ebe0019fbafead0722e2ab5e87b3ddc3e2c6a2beab2ab4ca36d6fa22835e6a88827eaba8f0fc9f0819a94e69fe3049539a389076b6baa8521fd","ssdeep":"192:NCddw24WrqKnbqGIwV4Mrz7xCAAN21/rqbnbqGIwV4RazqbCuuH2PlrqxnbqGIw3:0AYqY4tjXqY4ahhqY4tU8qY4Z","tlshash":"3ba22ba00027185063431de623de7e34ee0fa2657048d0766bfd8b9beedad6963b435d","first_seen":"2025-09-17T06:09:26.673739Z","last_seen":"2026-09-20T12:24:47.602594Z","times_seen":19582,"resource_available":true,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":2,"connect":16,"send":0,"wait":36,"receive":0,"ssl":37},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/Banner-scaled.jpg","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.941Z","timestamp":1789899740941,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/Banner-scaled.jpg HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 07 Apr 2025 19:23:50 GMT\r\naccept-ranges: bytes\r\ncontent-length: 83407\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":83407,"size_decoded":83800,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 2560x1170, components 3","md5":"6d308cfc2521338356d0e100d3eb8932","sha1":"05e4e07e32d103e2f2d657948c214807f774648b","sha256":"091e9914cb2c86f5a669d5a77b6bf9b491215cefd16cd72d72f4a1301eb9854f","sha512":"0680c88ae3ab634276ff060f5f4abe2df1cd2cf459b75378f698a806a9870c7ae53d4666b030600afae6ee5822000f31ce3421e6e7a268965c50531642043bc0","ssdeep":"1536:331zp+i9uJZl52lvGsOfeGVY8/oIF6S/d1UYDqOCmzXPVzuXde3v:npsi9uJZl5avG92GVYrSd1UYLzFuXw/","tlshash":"69834a038c498b83f53997e8fe431a9d6f19321cf99339ee15638ee778202550c9e17a","first_seen":"2026-09-20T10:15:22.490864Z","last_seen":"2026-09-20T10:23:11.947018Z","times_seen":2,"resource_available":false,"data":null}},"time_used":276,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":162,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/fonts/icomoon.woff?v=1.6","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.996Z","timestamp":1789899740996,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/fonts/icomoon.woff?v=1.6 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/wp-content/themes/salient/css/build/style.css?ver=16.1.3\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: font/woff\r\nlast-modified: Mon, 07 Apr 2025 18:57:41 GMT\r\naccept-ranges: bytes\r\ncontent-length: 21912\r\ndate: Sun, 20 Sep 2026 10:22:21 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":21912,"size_decoded":22225,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 21912, version 1.0","md5":"907bc7d21fdc1b3045d824ddd359db8e","sha1":"bb9ca1cfa43ea8dadd221b4428014d3b350e5e6a","sha256":"253da3174fd517b8b572319807f488b09d2d8c73f0a654361b493fd6b72cc3b1","sha512":"9c42f7bdf90e17aed54f555fc27d6d25b9559e5d45e84f6ef2226f6a2f2558f0b802c7898ef5ea7a1718a9b9948251f6b9aa6f0d89f94afd46abac59de1b5e81","ssdeep":"384:Bm+sn/05DNN6jdhvdMChAtJ06rdexsBcX9XkpC7AqxLrIAqKXOd5:c+sn/2NN6jXmChJ6QxwpC7bxnIAfA","tlshash":"a2a24c46c779ef0fe82697319987a2121df4a701d63e538ab8c7198da880cf48dac75d","first_seen":"2023-09-07T01:30:38Z","last_seen":"2026-09-20T10:23:11.947759Z","times_seen":2227,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.999Z","timestamp":1789899740999,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://zahrabeauty.ca\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48320\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 16 Sep 2026 10:31:22 GMT\r\nexpires: Thu, 16 Sep 2027 10:31:22 GMT\r\ncache-control: public, max-age=31536000\r\nage: 345059\r\nlast-modified: Mon, 15 Sep 2025 16:30:41 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48320,"size_decoded":49133,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48320, version 1.0","md5":"dcf31ebe107435bd68e0164d59e19b87","sha1":"b68160c9333af833fe483928b3ef7128c07a56a0","sha256":"d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0","sha512":"130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08","ssdeep":"768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE","tlshash":"1623f218f29471f7edecd4d500a18c72baa528d442f116ed07b8d53ca36ca817a729fb","first_seen":"2025-09-17T00:07:53.723302Z","last_seen":"2026-09-20T13:46:39.389768Z","times_seen":343729,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":17,"dns":0,"connect":0,"send":0,"wait":18,"receive":36,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/image-122.webp","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:21.016Z","timestamp":1789899741016,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/image-122.webp HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 27 Sep 2026 10:22:21 GMT\r\ncontent-type: image/webp\r\nlast-modified: Sat, 19 Apr 2025 01:11:06 GMT\r\naccept-ranges: bytes\r\ncontent-length: 45280\r\ndate: Sun, 20 Sep 2026 10:22:21 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":45280,"size_decoded":45673,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d969c6333d84c90ed1d8119a6166b344","sha1":"f79f87a8853b5d3612419f2772e6177a28c3af3f","sha256":"46164988b5b005b1d6c418acd66d224522418c56aafe97f15613d4f391bb2cd0","sha512":"1912205e92aa4837fa2e727e42a9bd2becccfbfc0910f36a4ecd9c62026cbb3be6d7df9e7ff949b9972560518e88533bc6bb4db24a200f18a41658af4536cae8","ssdeep":"768:GTpXXxGliNnC9ca0pmYdylJhmuOZ7nyx9t6kyS7dM0JAJK0kbdymjYLYcnueyWLi:iXAliDa0pmDlRu7yR6QRFdymjYMQyWFg","tlshash":"8013f164aa79b906e15642f18d0cbbf233fcd8925b0a800b7515789e206b7cef7645f1","first_seen":"2026-09-20T10:15:22.492516Z","last_seen":"2026-09-20T10:23:11.948985Z","times_seen":2,"resource_available":false,"data":null}},"time_used":238,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":208,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/laila/v20/LYjBdG_8nE8jDLypozNHjV8.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.992Z","timestamp":1789899740992,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/laila/v20/LYjBdG_8nE8jDLypozNHjV8.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://zahrabeauty.ca\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18836\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 20 Sep 2026 08:14:01 GMT\r\nexpires: Mon, 20 Sep 2027 08:14:01 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 25 Jun 2025 16:58:22 GMT\r\ncontent-type: font/woff2\r\nage: 7700\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":18836,"size_decoded":19647,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18836, version 1.0","md5":"4fa32141f2021a80d1588600a81dc461","sha1":"10a2da4cf590e820a27a5ef914aa038a9d0caa59","sha256":"db2c12a39ee66ff61252e06f895761c7c15aa39bf4e3c4998c1c7eb94ef815db","sha512":"48ba1306f23a9eadb571a94d709b43cdcc667f8f6443d6f8def2e0178200ff7bef2647b482048f71f4d99d9e75fcbad79b37f7da8b6f7fdd2bf0779bb5b7ea6a","ssdeep":"384:apq5cqi/Ljw8hNWwXxehT5QJ6AMC6kdwPbcgIpFxjtro3y154P2UIlo:ap7PhXAnQknC6gwPbc7Fxp34Pvao","tlshash":"1a82d09b1b26b1a6e3e204b56c4922d4b36c1367d2a3637c6f3e1c22e085ec6a711916","first_seen":"2023-09-17T00:50:07Z","last_seen":"2026-09-20T10:23:11.949712Z","times_seen":57,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":21,"dns":0,"connect":0,"send":0,"wait":39,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/Group-1171274896.webp","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:21.013Z","timestamp":1789899741013,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/Group-1171274896.webp HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 27 Sep 2026 10:22:21 GMT\r\ncontent-type: image/webp\r\nlast-modified: Mon, 07 Apr 2025 19:50:33 GMT\r\naccept-ranges: bytes\r\ncontent-length: 106096\r\ndate: Sun, 20 Sep 2026 10:22:21 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":106096,"size_decoded":106490,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"774557e9ad44cd97b6e505524010f9db","sha1":"2ac17c688c6ce99ce87e4f5b1bfe80d5ca9d3803","sha256":"8ef1e84ccb627f9533ec21768d8ad400a02e24de8db60150a910258c5a7a851c","sha512":"8acbaac67efebfbc90b7383ed0c707c9d59c1481f291d03c604c1bc2ef329a232d980da5c2b5ff6b9af87640f10b420f2aae9498485bd8334b0622ab9b7e0869","ssdeep":"1536:VCIWSuSnmP+9kJKEiOfhrtiv8WfApKbcFYulS1n9G8g8PttwEPZ/8FMM+uM7Mxv2:VCIWzUV9kLlh57WfA0htqEPZgMZP+n2","tlshash":"c4a312971eb428bfe28b65f073e016369aba1d75602fb57fcc900ab035545c38e43766","first_seen":"2026-09-20T10:15:22.504703Z","last_seen":"2026-09-20T10:23:11.950394Z","times_seen":2,"resource_available":false,"data":null}},"time_used":243,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":129,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/build/off-canvas/core.css?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.627Z","timestamp":1789899740627,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/build/off-canvas/core.css?ver=16.1.3 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 18:57:42 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 3249\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23134,"size_decoded":3684,"mime_type":"text/css","magic":"ASCII text, with very long lines (23134), with no line terminators","md5":"07e3e5bebfd51391fdce8f22e2227f60","sha1":"e68ffe20de185ad1b4bf46c2d8bb958170e34545","sha256":"0ef88a12bb81ac87af9f1264db481ff55b3d81511c4a6b51f0c331b64a69a71b","sha512":"bab7b9859691ac69163f356b8b6851272bd2c1f4ca0b95d344213a539540f25ebf30f58d8d8eb69c5c00e558325cbb2650c5cad7e14dcdcb6715cff70429b0bd","ssdeep":"192:x5aS2lGRGqabW+pRJU4rXN4zbd5lslrkj9Q+b05IZraCjy+kRbbzWl/Zujdbb6B5:WZW+pRJI67Ssa","tlshash":"d5a21c82f8935bec2e93458565c0d7a1072402c6ef3b7cf57dc0fa8c97095af31a65aa","first_seen":"2023-11-20T19:43:21Z","last_seen":"2026-09-20T10:23:11.951155Z","times_seen":1311,"resource_available":true,"data":null}},"time_used":251,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":235,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/jquery.mousewheel.min.js?ver=3.1.13","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.632Z","timestamp":1789899740632,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/js/build/third-party/jquery.mousewheel.min.js?ver=3.1.13 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 07 Apr 2025 18:57:43 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1088\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2711,"size_decoded":1490,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (2620)","md5":"2a651f118ed794f9bdc86ef7eb86859a","sha1":"044daf3a8f2789d7b80948dcf640bb72775f9df0","sha256":"c962e74a0cd768609b29c247028bd61c3229a50bb3abe908feeaa98962eb0971","sha512":"29a20f42ba55bcde7849aa21b8a26be89d0911cf480197557fd53c12566ab076ba56c34b789ada36b41b679b0e5017ea2f845f767dcd0041c0f5ab1c9bb616d1","ssdeep":"","tlshash":"7a514158771632f341fa1b29e12f7702703bd026104220a2b6bd9d80bb56eeb5367e1f","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T12:00:45.99204Z","times_seen":6212,"resource_available":true,"data":null}},"time_used":249,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":248,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/Frame-2095585848-scaled.webp","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.942Z","timestamp":1789899740942,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/Frame-2095585848-scaled.webp HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: image/webp\r\nlast-modified: Mon, 07 Apr 2025 19:50:08 GMT\r\naccept-ranges: bytes\r\ncontent-length: 13850\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":13850,"size_decoded":14243,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 2560x955, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"bd19b84f0cb284021e8c2634bd5575b1","sha1":"e51172212e23b7a28c891705e4838465c8e019b1","sha256":"19e8a747f63e108e93e71b520bec7ef2999b2696b71087e7b722f7c87153e807","sha512":"a5f3cdd602847f644029b07b269bdcae94fc8889100b93b6651f9351f104496bca0354062909e10170cb797825cc3d132f9dbe988387c8d80d72f9fac0de8ab0","ssdeep":"192:x3/55zL7Km4nti5Lx5m5USC5OfDJC5oTVn5TQ5X5I+LU55cBn1cr5+5zh55P3Q7u:AISdNC1n1cKFg7IR7rjNcPxUudgeUxj","tlshash":"775207a4201d5407f60aafb9f4d0ff8a9c209d3981c159ec79bf602257026d8f66f9db","first_seen":"2026-09-20T10:15:22.479661Z","last_seen":"2026-09-20T10:23:11.952453Z","times_seen":2,"resource_available":false,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":130,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/laila/v20/LYjMdG_8nE8jDLRagCY.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.987Z","timestamp":1789899740987,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/laila/v20/LYjMdG_8nE8jDLRagCY.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://zahrabeauty.ca\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18684\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 16 Sep 2026 18:50:22 GMT\r\nexpires: Thu, 16 Sep 2027 18:50:22 GMT\r\ncache-control: public, max-age=31536000\r\nage: 315119\r\nlast-modified: Wed, 25 Jun 2025 16:58:25 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":18684,"size_decoded":19497,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18684, version 1.0","md5":"17b13d28aea297d955885e34932db103","sha1":"18990132a8ac71fe03b77a38bf228a9b11686964","sha256":"83dcda96283e01cab57ab7e295f09ee8c52baa150e1421313d4fdc9396719d0d","sha512":"eb348cee8eeea34a778ec62fde7a6385c4e2200ba855177fe5fb575e9752e91896582ae8197fdabf014df1941ae0dd48452cad91a166b2446d24f66e095d92ff","ssdeep":"384:WTwWUcEHUN0zcdU9nB0aThfaN/Mrd6bYP6OQIPYQUmLVnGAOhgLDOsSKdNFF:WTwWC0No0KnB1wJMrQYP6CPYQU4nUgL1","tlshash":"2682d0b0f21066d0d8ce2b339926e40b2ee1549f546d2a86d24d4d3a574f8f9827735f","first_seen":"2023-05-18T15:16:55Z","last_seen":"2026-09-20T10:23:11.953188Z","times_seen":123,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":3,"connect":30,"send":0,"wait":27,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/plugins/js_composer_salient/assets/css/js_composer.min.css?ver=7.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.617Z","timestamp":1789899740617,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/plugins/js_composer_salient/assets/css/js_composer.min.css?ver=7.1 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 18:59:02 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 5864\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39738,"size_decoded":6299,"mime_type":"text/css","magic":"ASCII text, with very long lines (353)","md5":"051a48cf0660a088e37487842a8896f9","sha1":"849db5ebca8e63d8883377ff07c91fc6f21b601d","sha256":"a2b4c3ad220c8d28533887965fbb1e6c1382588d200eb9d95250f929a567ba1a","sha512":"41d81a48d117cc79ec5dca1793dbe56ff32024c04992e1be3f3e0b99c772fe5baaf629699e7cad6b7501118b964ee24dcc5fd17e146b21c2aa58d6bb1f356ffa","ssdeep":"768:K1B1FFNOiRE82RhSTCLlz6lM/9caVZ2YTTAqoCU/Gke:K1/hTExRhSTCLlzoM/9caVZ2YTTAqoCx","tlshash":"7c0342645dfa08101717811857ef731832a7917395099eecbb8ee68ccfc23ac41aabdd","first_seen":"2023-04-09T21:03:48Z","last_seen":"2026-09-20T12:00:45.994889Z","times_seen":3314,"resource_available":true,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":116,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/build/style-non-critical.css?ver=16.1.3","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.625Z","timestamp":1789899740625,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/build/style-non-critical.css?ver=16.1.3 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 07 Apr 2025 18:57:41 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4707\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":25646,"size_decoded":5142,"mime_type":"text/css","magic":"ASCII text, with very long lines (25646), with no line terminators","md5":"45e001e9a476bc6aa8312923ee953b5a","sha1":"0a6e5b6414e4fc559ce0c4accfadfcd2f27df913","sha256":"2af9b4fec27508b453812d713ab62650f4f46f85ad2dc92bf910c0253126d6ef","sha512":"eeff6a069222591042e42cfed5240e970ab4b101255faeacf3d27939df49376c4fd8079d14eeb095748dcbd90a16dac492e5b14c9540bfdd126cf08fd6117691","ssdeep":"768:RRe56M1xBS50PLZlVsVG4mRJGojXLJTxg85Q58MDt:RRe56M1xYePLZlVsVG4mRJGojXNTK","tlshash":"feb2835cbb4c0a0a2717436595cd53741b2ca492f7221aadf43f445f829a08973bf7bb","first_seen":"2023-11-16T19:52:38Z","last_seen":"2026-09-20T10:23:11.954335Z","times_seen":4106,"resource_available":true,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":206,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/js/build/third-party/superfish.js?ver=1.5.8","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.642Z","timestamp":1789899740642,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/js/build/third-party/superfish.js?ver=1.5.8 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 07 Apr 2025 18:57:43 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1967\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5692,"size_decoded":2369,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (5692), with no line terminators","md5":"beca72584b7b6df68f09cd56acd813cc","sha1":"c3788c2e7bcfbdb9067fb5579e9cf323609a2187","sha256":"e40c49d2d7cfc035902c7b8471e9736b9a05b2adc59ed919567063676d3b793e","sha512":"1667bb61b00af922a31e247b96ca2641faba9500020bf27f957caf91f87f582d832b6dc3b4c885e5031416c871b8f803cd13d670614ae5a76b351786bab71b6a","ssdeep":"96:PQlNKX1zRos8L1M8EZI8Y2VWSfxUeNBhQ4lMq3Yd2HD:PFusSOu8YxuDh1L","tlshash":"a8c1c7c8b24650f263fb6b99907e6606b1b61a1ca8284114f5379c7a0f6fc44b273f3d","first_seen":"2023-03-07T12:09:20Z","last_seen":"2026-09-20T12:00:46.014169Z","times_seen":3539,"resource_available":true,"data":null}},"time_used":292,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":290,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/laila/v20/LYjBdG_8nE8jDLyFpDNHjV8.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.994Z","timestamp":1789899740994,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/laila/v20/LYjBdG_8nE8jDLyFpDNHjV8.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://zahrabeauty.ca\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18816\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 14 Sep 2026 07:03:24 GMT\r\nexpires: Tue, 14 Sep 2027 07:03:24 GMT\r\ncache-control: public, max-age=31536000\r\nage: 530337\r\nlast-modified: Wed, 25 Jun 2025 16:58:35 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":18816,"size_decoded":19629,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18816, version 1.0","md5":"08adba4bfbcda52ae127a2d50dbe8b92","sha1":"5f539128f9a7a03a2e5878d98835d9ee866958de","sha256":"47e2f950ca0f931557171f697f46184830512e12e6538516a372c3f8f903d111","sha512":"0b33f93959f2269c4244972c5fcb7214f00f5bfe45efd2cda6ccaaa7478498c5229393b9e7a5f9b034a01ff15a6b4dea94f3f482cd70feff936a6db3f4195a23","ssdeep":"384:u4cFEQtWv+sSGRblGnhMgTZxqVC4d4SrQjEdM3hHGlc:AMv+VGRblA/T3w6CQyM3RGlc","tlshash":"6d82d196dbb14470d8fe0ffad725fdb653a221dd65a02f61308f8dc04984bc6265e0b6","first_seen":"2023-07-08T14:00:57Z","last_seen":"2026-09-20T10:23:11.956087Z","times_seen":69,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":21,"dns":0,"connect":0,"send":0,"wait":33,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/Group-1171274907.webp","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.949Z","timestamp":1789899740949,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/Group-1171274907.webp HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 27 Sep 2026 10:22:21 GMT\r\ncontent-type: image/webp\r\nlast-modified: Mon, 07 Apr 2025 20:43:08 GMT\r\naccept-ranges: bytes\r\ncontent-length: 49134\r\ndate: Sun, 20 Sep 2026 10:22:21 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":49134,"size_decoded":49527,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"231f05efe1021a9512856ca3bee5f332","sha1":"e2f4563513f6aba277c166f875ad55c066df3c06","sha256":"82e5a323f561701dedc786c75c7338987a310ecdad84be88b01715e3b3ec7dc1","sha512":"b07a6137f1ae01a75c68021df5636b749128d23ce36d64ba6073cd0bd4351000638e65af1f8b5ac6f69f9bd0b676f5acd70bd8f2a5caf2ba85cb3d941050d336","ssdeep":"768:aTKg8n+Kpgcu+4812qgX0Jbn5jRGeto+kSMFcOgyvgNjE3AVFKS40ojsZ0:chbcIqgX0LRxtoH7RYHFgsZ0","tlshash":"9923f1bc186bf68decd2653ab6cf24d00f8f788597c06b3ef26044f43819e244c69665","first_seen":"2026-09-20T10:15:22.502634Z","last_seen":"2026-09-20T10:23:11.956676Z","times_seen":2,"resource_available":false,"data":null}},"time_used":273,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":140,"receive":133,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/themes/salient/css/fonts/fontawesome-webfont.woff?v=4.2","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.997Z","timestamp":1789899740997,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/themes/salient/css/fonts/fontawesome-webfont.woff?v=4.2 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/wp-content/themes/salient/css/font-awesome-legacy.min.css?ver=4.7.1\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: font/woff\r\nlast-modified: Mon, 07 Apr 2025 18:57:41 GMT\r\naccept-ranges: bytes\r\ncontent-length: 98024\r\ndate: Sun, 20 Sep 2026 10:22:21 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":98024,"size_decoded":98337,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 98024, version 4.7","md5":"fee66e712a8a08eef5805a46892932ad","sha1":"28b782240b3e76db824e12c02754a9731a167527","sha256":"ba0c59deb5450f5cb41b3f93609ee2d0d995415877ddfa223e8a8a7533474f07","sha512":"9c776dea55a01fd854ea23b3463d9ac716077d406ecbe8ed0c9b6120ff7e60357f0521ab3e3bf9d4e17ca2c44a5d63ee58a4e7a37a3d3f26415a98d11c99e04f","ssdeep":"1536:Te9lM9ITKMpPtandzpLwETpNfdFj2yExmni83X3t4MCWzSBE2RM5RgUAkzm7zl+b:VWKQta9pBNT1n3X3BnmBI5Wx7zlvKfF","tlshash":"c2a312845ab5133bf704b97043bf87704a5a711ebeadad7158c3618d7faa39834006ee","first_seen":"2023-04-05T07:45:03Z","last_seen":"2026-09-20T13:56:45.217258Z","times_seen":39512,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":150,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/2025/04/image-31.webp","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:21.015Z","timestamp":1789899741015,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/image-31.webp HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 27 Sep 2026 10:22:21 GMT\r\ncontent-type: image/webp\r\nlast-modified: Mon, 07 Apr 2025 20:03:44 GMT\r\naccept-ranges: bytes\r\ncontent-length: 18618\r\ndate: Sun, 20 Sep 2026 10:22:21 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18618,"size_decoded":19011,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"13a1de9fef2e52df59b69e981049f2ff","sha1":"ac1c28eb6d52074099ff0ccd05e6bc8e750cf427","sha256":"a2a3b0b6529e39e2289299e1f64b8141880c631afc4b31b364d8463553aba41a","sha512":"1f93f8eca0ba3e06f798bd847bee957174acc500aab33b3c7548a0b546c072892674d6006956ee9834ff2f6b95368e636e3f854e75c698addc295206fc8520cd","ssdeep":"384:fwTj3QOdbKqzMrVnaYJyqbzSKo3TlKK8uTZtji7IKw7Jrj6Lwn4ZHu82e3l:4TjpmqzMkq/SKoUK3vW4rjb0O811","tlshash":"9a82e11f1a146a29e194da7ccc480f221ea70d783e9fe0cb41835b9060a89bd1c7cf9a","first_seen":"2026-09-20T10:15:22.537115Z","last_seen":"2026-09-20T10:23:11.957969Z","times_seen":2,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-includes/js/wp-emoji-release.min.js?ver=7.1.1","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:21.377Z","timestamp":1789899741377,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-includes/js/wp-emoji-release.min.js?ver=7.1.1 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Fri, 10 Jul 2026 04:28:33 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4974\r\ndate: Sun, 20 Sep 2026 10:22:21 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=604800, public\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22752,"size_decoded":5376,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (19813)","md5":"7dcb0bb1f67bc5cd9aa86bc0577108e3","sha1":"c90b1ed149a278c322a63f3a79443ccce5592382","sha256":"063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3","sha512":"d09c60fc702e1d3fb839685770b2626a64cbc6373ac4bf3a63c3536caef34f4f6caf76adfbd5c2d15bed6e1396ed4f3ca80f6673e3421b2ae2f9e7aa5ccf16f2","ssdeep":"384:WzevzApRZTbbUL3px/bEg1XgA5OOkpJTX:Wsk9bUL3px/YqXgAP+hX","tlshash":"79a2949ba33a4e8f343e3bd78d968f4dc9da555321c0e079dbefb6c169a00568274c90","first_seen":"2026-06-05T05:27:24.795617Z","last_seen":"2026-09-20T13:54:31.745336Z","times_seen":58533,"resource_available":true,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zahrabeauty.ca/wp-content/uploads/salient/menu-dynamic.css?ver=54966","fqdn":"zahrabeauty.ca","domain":"zahrabeauty.ca","tld":"ca"},"ip":{"addr":"68.66.216.8","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.616Z","timestamp":1789899740616,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zahrabeauty.ca","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 22:11:02 GMT","end":"Sun, 29 Nov 2026 22:11:01 GMT"},"fingerprint":{"sha1":"FD:8A:61:36:D5:1A:C8:C9:92:0F:60:14:1E:C9:1A:65:43:C5:C1:0B","sha256":"CC:A7:50:7F:59:BE:FE:AA:46:8F:B9:94:6A:71:0E:0B:F7:E4:A9:B9:4B:FE:8B:60:3B:05:06:88:4D:B7:76:77"}}},"request":{"raw":"GET /wp-content/uploads/salient/menu-dynamic.css?ver=54966 HTTP/1.1\r\nHost: zahrabeauty.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: max-age=604800, public\r\nexpires: Sun, 27 Sep 2026 10:22:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 20 Aug 2025 21:42:52 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 766\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4124,"size_decoded":1200,"mime_type":"text/css","magic":"ASCII text, with very long lines (4124), with no line terminators","md5":"d7db0ac4f7fccb30f70ad595708d4c81","sha1":"a2671bcdb549f5041c2e739ea5f2d230802fd3a1","sha256":"13e4707c8a478039077986c3124afc7a6a13b41c92a082614255123e65434613","sha512":"dca40ef65312ce246b2383d1c42421ba8b327e791639dec2632fc7a874282b23ab63d827e3b929299139d20c86521e798c5f54724e701743764f5a80db2fd357","ssdeep":"96:9lCTJFpgauXdNzg698TizNI4DyDmzHAW6RzKX35yG:SJ7gaC9VNTimHn","tlshash":"a4811fa8ae83027a1d1723502dc9d3602b951485ef627667bf3996af9d0b201f4f30e7","first_seen":"2023-09-07T01:30:38Z","last_seen":"2026-09-20T10:23:11.959105Z","times_seen":3353,"resource_available":true,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-20","alert":"Sinkholed","trigger":"zahrabeauty.ca","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Laila:500,400,600%7CWaterfall:400\u0026ver=7.1.1","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zahrabeauty.ca/","date":"2026-09-20T10:22:20.621Z","timestamp":1789899740621,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:15 GMT","end":"Fri, 27 Nov 2026 08:06:14 GMT"},"fingerprint":{"sha1":"4A:94:E8:7C:D6:24:98:F0:09:11:DC:AA:71:9C:1B:6F:0E:37:D6:F9","sha256":"27:EB:1A:85:AA:03:02:5C:92:96:B5:9A:18:1B:65:94:2D:6C:B8:A3:56:3D:E9:F8:5F:E3:62:83:5C:A8:C0:59"}}},"request":{"raw":"GET /css?family=Laila:500,400,600%7CWaterfall:400\u0026ver=7.1.1 HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zahrabeauty.ca/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 20 Sep 2026 10:22:20 GMT\r\ndate: Sun, 20 Sep 2026 10:22:20 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4518,"size_decoded":1318,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"ca1300200b86f9d18f61f3c9c4337ba0","sha1":"490f6c1babaad977e4d46307030c36a70d234117","sha256":"fbce4c97b0a150d564bd447f86377f27353504f0234864d7c490801a76edb327","sha512":"472ccc261bff97e2f8891a72ca113b708be2b158a848f22d2da6dbcf3cc2ea080429b3b73c55ccbcc5a99727ff3d7d345488cfd5aff0d47e46da2e96d2f9709b","ssdeep":"96:8OL2fOLwJc+uCOLJNhOgvI/OgvIJc+uCOgveNhOxTvvOxTv1Jc+uCOxTvDNDrOLq:h2aEkTvIdvsPvZvov92vtuyryWdyA","tlshash":"0f91e192042ba5009b930cc922ce7d32df4f624564859576affe18c9ecfbd3653a1b4d","first_seen":"2026-09-20T10:15:22.477619Z","last_seen":"2026-09-20T10:23:11.959643Z","times_seen":2,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":14,"send":0,"wait":52,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}