{"report_id":"4474d594-a1ea-4e69-aec6-0f9303f4723b","version":6,"status":"done","tags":[],"date":"2026-02-06T21:26:46Z","url":{"schema":"https","addr":"qd1.zalandoa.net/","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"172.67.202.131","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"qd1.zalandoa.net/","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"title":"Telegram Web","dom":{"size":59458,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (59458), with no line terminators","md5":"7f1ef1e1b839040a5bbc5e450d8463d5","sha1":"5bf0a17fa9a90e3604bc61109fe0dd6a4641ce58","sha256":"8511529e14570a4a0ae636fbe35984ea6d65dea7a6794b2bd27f8e504ed20520","sha512":"0401a5bb85621be19913b57667a3ae5f512b53e2fce2fd58cbcf9c02868c4043abbaba1d5975fbdc52e94ad047651a75fb7c3d45a4a3158f054846fb11be8b41","ssdeep":"384:k7llhHC4VK8Fnl7fWnvIo+8tQtitX5VJj:kZlZs8FnlinvIH8tQtitfF","tlshash":"244398a85dc85b298e08d78fc5db5dec1099c1c68808805fbb756aa7c67cd34acbc397","dom_hash":"domhash17387ba4d1f5495b3b0c76426b275437","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"qd1.zalandoa.net/","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"172.67.202.131","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-13T21:26:46Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"qd1.zalandoa.net/rlottie-wasm.5e3833cedb8fb71c8d8e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"qd1.zalandoa.net","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-12-31","domain_rank":0,"first_seen":"2026-02-06T21:05:37.722784Z","last_seen":"2026-02-06T21:05:37.722784Z","alert_count":82,"request_count":39,"received_data":2486158,"sent_data":17931,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"zws2.web.telegram.org","ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2003-12-15","domain_rank":491032,"first_seen":"2021-06-24T06:55:52Z","last_seen":"2026-02-03T14:46:54.089219Z","alert_count":0,"request_count":1,"received_data":220,"sent_data":598,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"qd1.zalandoa.net/3748.0fa60c5a44d4b42a0115.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"02161e4617efa57e5c0ab5ae61300dcd","sha1":"bc99b5da6161b06d78a7f88119cd45f2dd826fbe","sha256":"46ff1f7377f83f6826433319f1a08efbebd39b4eef483c4924416a80df01a73c","sha512":"a0a0d04082edf186c5dffafa33cc7b97c4876d5d89f3909679ab76873325412fbd5579d8dee69308355e9eb33f9b02ace931413569389d49029cdfedfe68d7bd","ssdeep":"192:2Vcn1feShD/DSPaDamkt0M/YPAoDc+EuGsVczzS8W6DWAVYBB382c:2VIUS5/DSCGmkmMA7D/EuGsVgzSlkWMJ","tlshash":"9112e981b132747e626795c6e6084a03aa3591587c0da1bdf77c78fb2c9580b34bcf79","size":9834,"data":"","first_seen":"2024-01-25T07:46:59Z","last_seen":"2026-05-30T12:54:11.799578Z","times_seen":492,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/1915.7c097c4f98f78164d509.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"da88a8550ef58d5fed48f5d54f88ee08","sha1":"51fe5562057d56bfeda2d6bb6ed3ecb449cfd927","sha256":"207f18121e4a48210dd0aff08d57b1fb9af346a17e38d57d60be15a7f5c733f4","sha512":"7b692a2bca809aef1f70ea065592c62e447f0b4c5b3040c43dade1bac520d030467ec9bf1528e6be058c0e436dd0794d5129449461a6d18c2a263de7e4ac7cb1","ssdeep":"192:R/kF3DWtg5I3cTKk/Q4yZOXG/lB0wKqwztTSuIdmPignIi7SdibRs1YpZNWBvYAL:RI3Dbac/TW30J/tBROZXyEW0NZubU","tlshash":"5282e76bee110c2e02d351a7f9ca3106b5b982a6d2505470d36dd06f03ed8de367fb69","size":18138,"data":"","first_seen":"2024-01-25T07:46:59Z","last_seen":"2026-05-30T12:54:11.792184Z","times_seen":489,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/6839.01a53cbedf5d86d252ec.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2075f46f0950d8614b73045505b7aafc","sha1":"34da1902bc42580deab249ac8ef5c4901d243a43","sha256":"f693fccbb0f64594079d492db05d3bced69a6c6cab7514d4b78733570fd592a1","sha512":"c86f9062cfe41a8cf4e7e2d3f5767c6b6ecb64aedabcca5e9dd67914bb914bc50d5cd93861f98817725b6309805c8598715e31eb3104978e40a0d9dfa734c88e","ssdeep":"768:Ee+ebTqPIHWzl/cIO4HI+ebv3djbql2cPg+bwTjhva4HASW:vb+PVzl/cIzdyw","tlshash":"8223e8a9b381a1b66a5695e3403b0447f138f6252816d06cf739c8de687cdc5b93bf38","size":45754,"data":"","first_seen":"2023-10-19T01:38:58Z","last_seen":"2026-05-30T12:54:11.777772Z","times_seen":652,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram.me/_websync_?authed=0\u0026version=10.4.5+A","fqdn":"telegram.me","domain":"telegram.me","tld":"me"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"b326b5062b2f0e69046810717534cb09","sha1":"5ffe533b830f08a0326348a9160afafc8ada44db","sha256":"b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b","sha512":"9120cd5faef07a08e971ff024a3fcbea1e3a6b44142a6d82ca28c6c42e4f852595bcf53d81d776f10541045abdb7c37950629415d0dc66c8d86c64a5606d32de","ssdeep":"","tlshash":"5430000000000000000000000000300c00000000000000000000000000000000000000","size":4,"data":"","first_seen":"2023-03-07T01:03:44Z","last_seen":"2026-07-24T03:50:22.635667Z","times_seen":425570,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"t.me/_websync_?authed=0\u0026version=10.4.5+A","fqdn":"t.me","domain":"t.me","tld":"me"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"b326b5062b2f0e69046810717534cb09","sha1":"5ffe533b830f08a0326348a9160afafc8ada44db","sha256":"b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b","sha512":"9120cd5faef07a08e971ff024a3fcbea1e3a6b44142a6d82ca28c6c42e4f852595bcf53d81d776f10541045abdb7c37950629415d0dc66c8d86c64a5606d32de","ssdeep":"","tlshash":"5430000000000000000000000000300c00000000000000000000000000000000000000","size":4,"data":"","first_seen":"2023-03-07T01:03:44Z","last_seen":"2026-07-24T03:50:22.635667Z","times_seen":425570,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/compatTest.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6cd5af9f25450b853670937767d78567","sha1":"64e00d45abe2aa9be5de3a0d0f654a11615104c6","sha256":"61b532b735c7efb7b45fb4c702583f2825a8f505d65af68c06acbd60a0018d1c","sha512":"5c93a87f67c7cbaec11c169d636fbf7bf4316c58554415f9098e38086b2d0ae692c52c99827584cf2452f53e829748d0e8164d221c6de25b4bd7dd813bc4b82d","ssdeep":"","tlshash":"7621d5195cf162a1907524653b1bb046b529d132891cfea4f2608f787fe2d5b434fcf5","size":1231,"data":"","first_seen":"2025-11-01T13:54:56.560427Z","last_seen":"2026-05-30T12:54:11.796957Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/redirect.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"17773b57b87a678c98e26a7cac72df6c","sha1":"7422857aa75ee81cabcec2eed6c4a6168f363ee1","sha256":"375141f2d3f04c733276dbff5d9208ff36b2db6a64abcee723179ac24797974f","sha512":"28d9e1c2af08154e653e2291db46f4110edbf9f5591192f8d695c8852f9c3c755d69dfb5a032a45f51e0a3fc9417f16c20d0772b1225ca9b85e5531e12fa8bfc","ssdeep":"","tlshash":"e8e07dda0279030417e013f36d82b4709137c2fb604c5d028d984321a1b9b4f5b7b84f","size":325,"data":"","first_seen":"2023-07-27T09:32:34Z","last_seen":"2026-07-20T07:32:01.79149Z","times_seen":11535,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/main.eb1f23aa1af37f3fe828.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"341fcfed04f03d040a96bda7b7105ac3","sha1":"f3c0bdab4f72f7893ec4164c9d6865b63fed28e9","sha256":"0ab199c740b0a83f146ccc5cfbd4f4c03f969a4aaeda0199918918424cd064a3","sha512":"25e468686b688d6ea82cc00cae3c192cf0c5ec759b6e4aeb8f256ef5f7dbad256526f0a3ad0e74a8d0372604023c4b1239fcc171b8b9f05554e928f1b8a0a02c","ssdeep":"6144:Ho7+DqmMfBkKbf8M3RF4LoWE9qGk+cFK4cMOKdYIW2oaeyBgoHUOJkEdKIjwpf:Ho7++mMfBkKbt3RF4LoR9qGBcFK4cMO1","tlshash":"01845cc57186b4a962e705e6a4eb0098f634590038098464f1bdfcde3e3699fa3b3f5d","size":379393,"data":"","first_seen":"2024-03-19T06:54:31Z","last_seen":"2026-05-30T12:54:11.789896Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"qd1.zalandoa.net/rlottie-wasm.5e3833cedb8fb71c8d8e.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","date":"2026-02-06T21:26:26.219Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /rlottie-wasm.5e3833cedb8fb71c8d8e.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-1005e\"\r\nexpires: Sat, 07 Feb 2026 09:05:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1265\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Kj%2BMc2f21Ci9cSA3gqGYIZFnmVRMnOPBfCU89XufusqmkifMYfAJK7Mqq77yI6VSjs%2BZY%2F010qLtuZVNV8xwA5Usaw39I5vNaZWnNcZf\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cdddb9712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65630,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"3559b2b89d032ebe64593c61c4ce75a0","sha1":"0f6cb82095dfedfff7a1eb3d320e6c991ff5f479","sha256":"8524c2222885bf761b5f366d8e1d465a668f7061f8fcc2f01250d446b2dc554a","sha512":"ea3bce8c1fc2cc640dae469ba6f6f01f1708999f5a6c3dfece28571b7292b81b435073b62e5ea7169c00d00bb8c1eb1c83fa878c215d0455a6db0d0a53e16aae","ssdeep":"768:O6T4cchKQ6eO1P2Wgcdxazvs5X0gBBqfRna76Ae/FqsSwYTRrqhlr3NqR:oMQ6eO4+IU5XYxjvq1alrcR","tlshash":"e353e88535d9b0ab42833878946f314bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2023-09-16T03:06:02Z","last_seen":"2026-05-30T12:54:11.794414Z","times_seen":575,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"qd1.zalandoa.net/rlottie-wasm.5e3833cedb8fb71c8d8e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/rlottie-wasm.5e3833cedb8fb71c8d8e.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","date":"2026-02-06T21:26:26.220Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /rlottie-wasm.5e3833cedb8fb71c8d8e.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-1005e\"\r\nexpires: Sat, 07 Feb 2026 09:05:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1265\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d%2BSOVciwOQDmvCXCtNumLVpnRUDAsYL2TaoXctuyl6B7GYNpZ7em35Wtx41qLEgqagPdDkQcvFZVBKCJyj85TERHm93QqVeLenH71rY9\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cdddba712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65630,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"3559b2b89d032ebe64593c61c4ce75a0","sha1":"0f6cb82095dfedfff7a1eb3d320e6c991ff5f479","sha256":"8524c2222885bf761b5f366d8e1d465a668f7061f8fcc2f01250d446b2dc554a","sha512":"ea3bce8c1fc2cc640dae469ba6f6f01f1708999f5a6c3dfece28571b7292b81b435073b62e5ea7169c00d00bb8c1eb1c83fa878c215d0455a6db0d0a53e16aae","ssdeep":"768:O6T4cchKQ6eO1P2Wgcdxazvs5X0gBBqfRna76Ae/FqsSwYTRrqhlr3NqR:oMQ6eO4+IU5XYxjvq1alrcR","tlshash":"e353e88535d9b0ab42833878946f314bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2023-09-16T03:06:02Z","last_seen":"2026-05-30T12:54:11.794414Z","times_seen":575,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"qd1.zalandoa.net/rlottie-wasm.5e3833cedb8fb71c8d8e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/rlottie-wasm.5e3833cedb8fb71c8d8e.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","date":"2026-02-06T21:26:26.223Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /rlottie-wasm.5e3833cedb8fb71c8d8e.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-1005e\"\r\nexpires: Sat, 07 Feb 2026 09:05:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1265\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zTAAORQQLh7%2BfO%2BcLJV8yk4wn716g8RK7LYexmZ1dzvd7JAiI4mVUjZIg%2BQ4zWJ3DBW6Fa%2FOZpeo3%2B2YzeWinqNQaWmeOPqO%2BLt02Pkj\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cdedc3712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65630,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"3559b2b89d032ebe64593c61c4ce75a0","sha1":"0f6cb82095dfedfff7a1eb3d320e6c991ff5f479","sha256":"8524c2222885bf761b5f366d8e1d465a668f7061f8fcc2f01250d446b2dc554a","sha512":"ea3bce8c1fc2cc640dae469ba6f6f01f1708999f5a6c3dfece28571b7292b81b435073b62e5ea7169c00d00bb8c1eb1c83fa878c215d0455a6db0d0a53e16aae","ssdeep":"768:O6T4cchKQ6eO1P2Wgcdxazvs5X0gBBqfRna76Ae/FqsSwYTRrqhlr3NqR:oMQ6eO4+IU5XYxjvq1alrcR","tlshash":"e353e88535d9b0ab42833878946f314bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2023-09-16T03:06:02Z","last_seen":"2026-05-30T12:54:11.794414Z","times_seen":575,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"qd1.zalandoa.net/rlottie-wasm.5e3833cedb8fb71c8d8e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/1649.23ef32650e96d33d6586.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/8415.070dfd3889c2a74f9cc0.js","date":"2026-02-06T21:26:26.261Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /1649.23ef32650e96d33d6586.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/8415.070dfd3889c2a74f9cc0.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-af5f\"\r\nexpires: Sat, 07 Feb 2026 09:05:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1266\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FcBKJFCYk2iqY%2FExvW9jbR6FSP40Q6i6sQlPMvK0Fsdk2BV3yI52ZN8G%2FKUr87vOEBi204xlUfDsaSbnghXaJnfzNDyncxIPwMwhIkh4\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9ce0de0712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":44895,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (44841)","md5":"d185f3823bb419e0227eb45b85facdca","sha1":"b50068ba63e52fd9d71dbfa7cb42fe82a6f4af16","sha256":"fbcc1367611f1d387d2b7340f92b66b4a0a5311742ec3d806d848692b98e78c9","sha512":"5dc4f3d4b251332baa45149f234148e139b0a6952fcac3d875d50dc162d6f6bb59dfc442da67cdf95d2825e5aeff9bb704d4242bf211c959cf0dc58bd0505331","ssdeep":"768:+9P7jiBBMXQhxKk3FnFJFb/N6rWfbBaZMCnMc1Hx3f:4/iBBgyKYFnFbb/N6rWfbkeYMYR3f","tlshash":"8b136484f6e2b0b1439371e0443b504af33e6a6ca44d80f8e695d4e278b685d967bf39","first_seen":"2023-10-19T01:38:58Z","last_seen":"2026-05-30T12:54:11.795061Z","times_seen":594,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/blank.8dd283bceccca95a48d8.png","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:30.758Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /blank.8dd283bceccca95a48d8.png HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://qd1.zalandoa.net/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 68\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\netag: \"65f5b2d6-44\"\r\nexpires: Sun, 08 Mar 2026 21:05:25 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 1264\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cX1EMhp%2BWdbTYVuvCaI0%2FO5%2FpMsh8BccDjpTX%2BQ3UGBytyuhToh7Xf93cW6mZlUh7lp28hq5Z3Uuygx6wnBASYzVDqMS0LFXq0zZxyGI\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9ea3996712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":68,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced","md5":"91e42db1c66c0b276abf6234dc50b2eb","sha1":"c1986af3c26609b8b7d8933f99c51c1a89e9ea6b","sha256":"63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058","sha512":"0b77019542fdb02f72c8407a379579bde36e2fe3af81b1c74553f1b5df2590373bf7e6ff3fefcbdaf0b9a2fcf9b1e57b30d24e29810f0cfaf9d51153415c89ce","ssdeep":"","tlshash":"bea022c223e0ec3cc38c8233c0000230f83000ab08000028202be0202e822e0088c2a2","first_seen":"2023-04-05T22:54:48Z","last_seen":"2026-07-24T02:49:51.712311Z","times_seen":35724,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/blank.8dd283bceccca95a48d8.png","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:30.777Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /blank.8dd283bceccca95a48d8.png HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://qd1.zalandoa.net/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 68\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\netag: \"65f5b2d6-44\"\r\nexpires: Sun, 08 Mar 2026 21:05:25 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 1264\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a8OP6jY0H3C9tVxuPSRjHJcJUXeh5NbN9ePzC8tr08aNdVGZJbGdsRqe80ABEfAbyjUHDaI9Hp9ddmyazWJL8vc7sbiyP5E2EXX2ahpr\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9ea59ad712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":68,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced","md5":"91e42db1c66c0b276abf6234dc50b2eb","sha1":"c1986af3c26609b8b7d8933f99c51c1a89e9ea6b","sha256":"63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058","sha512":"0b77019542fdb02f72c8407a379579bde36e2fe3af81b1c74553f1b5df2590373bf7e6ff3fefcbdaf0b9a2fcf9b1e57b30d24e29810f0cfaf9d51153415c89ce","ssdeep":"","tlshash":"bea022c223e0ec3cc38c8233c0000230f83000ab08000028202be0202e822e0088c2a2","first_seen":"2023-04-05T22:54:48Z","last_seen":"2026-07-24T02:49:51.712311Z","times_seen":35724,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-06T21:26:24.723Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:25 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Fri, 07 Feb 2025 07:19:31 GMT\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HTcoe6T3KZfByfNeoEr6PQWKz963sglFUBUg5ampELj5EgF820IbIBQd%2F19zrRsFHr4PZm1EpGXhhOYI9tGQDXYz%2BZyylF3RmgRSgZKb\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9c9db9c4f93e56a5-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3105,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (3105), with no line terminators","md5":"4376a660c07eea2ff751ee3af6309473","sha1":"d545cf197515596430f8c2136a571ccaf8a18e0c","sha256":"a242a34a0a4410ac6b43e0c8101e7fd3b5196469490acb22ee8601f35da9b7b5","sha512":"313b963ec751639f493138f108b57c4348f50f8633ccbf3149060223e58bfb3592a72025b0396a7f7ed9ac548f015edb0d6a500ceda29d623bdcaeb2b0830919","ssdeep":"","tlshash":"fc51f0938f18c84e2721963aeab3f0c8c216d80f99b57c51f58515ab49e2ff0d1b3265","first_seen":"2024-08-19T17:17:35.872918Z","last_seen":"2026-05-30T12:54:11.802347Z","times_seen":13,"resource_available":true,"data":null}},"time_used":911,"timings":{"blocked":77,"dns":64,"connect":1,"send":0,"wait":748,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/main.eb1f23aa1af37f3fe828.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:25.748Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /main.eb1f23aa1af37f3fe828.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:25 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-5ca01\"\r\nexpires: Sat, 07 Feb 2026 09:05:15 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1270\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HaWpx8RJRuZjSOA95nvm7WMxo4a2fe4QXQ8PIzdmuCj9h3XZlfGraKJaBZXx0XpDBstSZQvRUHyawy2BCKfqkKHai1VwJlrMS6fvAENf\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cadb5b712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":379393,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65533), with no line terminators","md5":"341fcfed04f03d040a96bda7b7105ac3","sha1":"f3c0bdab4f72f7893ec4164c9d6865b63fed28e9","sha256":"0ab199c740b0a83f146ccc5cfbd4f4c03f969a4aaeda0199918918424cd064a3","sha512":"25e468686b688d6ea82cc00cae3c192cf0c5ec759b6e4aeb8f256ef5f7dbad256526f0a3ad0e74a8d0372604023c4b1239fcc171b8b9f05554e928f1b8a0a02c","ssdeep":"6144:Ho7+DqmMfBkKbf8M3RF4LoWE9qGk+cFK4cMOKdYIW2oaeyBgoHUOJkEdKIjwpf:Ho7++mMfBkKbt3RF4LoR9qGBcFK4cMO1","tlshash":"01845cc57186b4a962e705e6a4eb0098f634590038098464f1bdfcde3e3699fa3b3f5d","first_seen":"2024-03-19T06:54:31Z","last_seen":"2026-05-30T12:54:11.789896Z","times_seen":17,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/notification.mp3","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:25.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /notification.mp3 HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\ndate: Fri, 06 Feb 2026 21:26:25 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 10880\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:22 GMT\r\netag: \"65f5b2da-2a80\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\nage: 1268\r\ncontent-range: bytes 0-10879/10880\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3rCopyYAjHhXnXB53AmStD5ICMoz%2F2jgQqowaOtTyYJeshrgnse4hhxuOAetExXNaSTnHDAPdSKqFYk8B9eZg8QvBmrTXvi2cxqa%2F5ny\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cc4c7d712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10880,"size_decoded":0,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, JntStereo","md5":"eba09b6a457792c52fc610b5f9f974b3","sha1":"95e6e0f7648e28ea21bc434054ea59aba3a35aea","sha256":"86093551f5a7f68c7dcac947bd8dc54c6a79dd9a5d83f7e40116d640eb28c7d6","sha512":"9dfc5ff830c9ed75c9923528c31e1361fa36500d76a209cd475984e5585a644c8aff1600bf02a658ef363436a51988ff1e63aa7606e541dc4a7b3449c5be4852","ssdeep":"192:RuQQeX7rYX/WUUIk8DLh+2BHpZqlXCYP69tuORf6tVQRa/nwNQBv5JC:RRYeUUEDLk2VClyaV0aZ5g","tlshash":"37226b18af11056ef4866bf0b3939b8dc42d26c37a26d4cdd3a5d7e369430e2a7d500d","first_seen":"2023-05-16T22:57:55Z","last_seen":"2026-07-24T03:00:53.303464Z","times_seen":16880,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:26.077Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /4680.2d9cfefef59f5d86edec.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-2814\"\r\nexpires: Sat, 07 Feb 2026 09:05:17 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1268\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=04%2Bkev0wRiOg2k7yvxQkeRAcKh5jtcYjNISONbVJACctX1ZSHP4gZKLp5geOn%2B2wFnA%2F5aeSUSkpYc35cr0mjW9kT5Cs4saMSgFV%2BnvK\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9ccecfe712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10260,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10206)","md5":"546e2512254f1abf3566e3413d69f034","sha1":"44596e4739dab279a46771809eb3d4a7216960f7","sha256":"542f89a1674a752e6edc50beb2aa66c92488b6084706e5f2d5e007123ea98348","sha512":"3998cc3d71f94ab39a4fad22093eb72266f82c515cce9a2777683c8faf718d26bd44390d17606211542eb91e986855ef6e98190b1ab4db4ad342d1b50a2b3f82","ssdeep":"192:+d05WVYG6G8UxYs1MlbKq2Y/WkFYmMWYW5zIf0hVetjFCfRCjkG6yScwLnhoK7RH:+1QUxYs1SdD/WkFYmMWYczTq5uCQGFS7","tlshash":"2a223bc03122783652936996a47f200374356b64784f9958721ddfea393bd8a7173ff1","first_seen":"2024-09-19T21:39:43.071073Z","last_seen":"2026-05-30T12:54:11.781398Z","times_seen":13,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/2041.5fe028b52e13d7a937b4.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","date":"2026-02-06T21:26:26.173Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /2041.5fe028b52e13d7a937b4.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-223ca\"\r\nexpires: Sat, 07 Feb 2026 09:05:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1266\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vnMhQWlQcaz3Y7vymZAk13hHenQAny5hbuDr%2BOhwJFTP1C6CJvCJVUY5QA973foxsC%2Bd9S6Bdyrx565o%2Bx5esSS390abqxWZ8Ev63xFj\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cd8d85712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":140234,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"39c6ccbfd0be3bc43e412a138b4c9f89","sha1":"440310a69dfb81c245f3cfeb4014a001db4ca72a","sha256":"c16171043dbabab93f501b594c1a988e99b034cd39dc6c50b1809a47d64036a4","sha512":"162dbe8f7f7ea25168abb7f275f3c24ac85fdd9880b85cf4cb234afa1bd823360394fd98b7c65f84f2734b360f1ecb5ccff5d596a28abffd825b8069332b82a5","ssdeep":"1536:hW3M14X1jDx480MHyQL3YLZHZp+snJhcssuovxz2Rs1:IXxq8mwmJs9N","tlshash":"0bd3c682f86424125382b1e654760709773af41ca9c941acfe6cfed569bcd8d32afb34","first_seen":"2023-10-19T01:38:58Z","last_seen":"2026-05-30T12:54:11.786422Z","times_seen":499,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/getConfig/147591","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://qd1.zalandoa.net/8415.070dfd3889c2a74f9cc0.js","date":"2026-02-06T21:26:26.412Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /getConfig/147591 HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/8415.070dfd3889c2a74f9cc0.js\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Fri, 06 Feb 2026 21:26:27 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TtLBEWXpzLr0uyXj815EOGyqDg75Uof0VhyyIek14HOQBIQjS4q3nvJXo7JqiuF9jPmT8sxLKex0MZLFfyObRg351Rn%2F1Jitih1MUh61\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9c9db9cf0ea2712b-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-07-24T03:31:48.875637Z","times_seen":543236,"resource_available":true,"data":null}},"time_used":831,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":831,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/chat-bg-br.f34cc96fbfb048812820.png","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:25.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /chat-bg-br.f34cc96fbfb048812820.png HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/main.4087993f942398d56511.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:25 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-780\"\r\nexpires: Sun, 08 Mar 2026 21:05:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1268\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1%2BPYyVjr2EOyOrF2FulzK7xs6ndidM0kZ4AxvwtVVAJgSoIJVGXMgPnOhycV10lZ0ZdrIP9unMjK0kkDZQXwEyvEg1JpVfjpArzarTT%2B\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cc0c3c712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1920,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 50 x 50, 8-bit/color RGB, non-interlaced","md5":"ff2989744d4813c906047582226abd28","sha1":"41b973276f7a99af05115b89b401aceb02f573c8","sha256":"3151f7930d821bccf4a76cbbe4a3533e2b56bdff696f260c864ab639ac7526ea","sha512":"add07f186c255e361094878a71eb4257c4e60a6e4908be168fbfac30f768b18e0e292f59e80d75d78eb79fb62c820c03c512f07bda6d8d1c323506e5d173bda2","ssdeep":"","tlshash":"f0413b8a645965a9ee6a1c2733c9314727d0c2911b46399284eb5d71ccce602d2d330e","first_seen":"2023-05-16T22:57:54Z","last_seen":"2026-07-24T03:00:53.314621Z","times_seen":967,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/chat-bg-pattern-light.ee148af944f6580293ae.png","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:25.933Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /chat-bg-pattern-light.ee148af944f6580293ae.png HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/main.4087993f942398d56511.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:25 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-429eb\"\r\nexpires: Sun, 08 Mar 2026 21:05:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1268\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4zDz1HTmRoHsdsy20ppJV3NH7brMLIdPSssEz6i9KXajgNg1y8ugmn5zEXxfsnXzg8IdsO7Qax87CF47ab6htnCxKQJvtsLi6PaPV2Os\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cc0c3f712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":272875,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1123 x 2307, 4-bit colormap, non-interlaced","md5":"3d558d8de7082a2b2355076c8988c3fd","sha1":"d74980e29b0ec2f102b0dcd614503fd42a255b85","sha256":"00745db819d91c37bf0f59bee00ab2efe9766fddcb726ff1bcb6847748b2bbc7","sha512":"5f6f62eba34a80efd63ec237536a288dacb799b1270d07f82b82f0ee280923349105acfab71333361ff3efdf64708cd682f89ac2831dc02d0d7357bb5c4c3926","ssdeep":"6144:rNYvpliapP4LNqNMaT3SU4+hRT2ieSaVTrewN69j+YOnZmDXxGjuC1:rNCpb+L7aum2Bt6hr/C","tlshash":"49442315c47c54964f1c08af035b679cb1939b8bfc16b33d67aadc0d32278d8a74baa4","first_seen":"2023-05-16T22:57:54Z","last_seen":"2026-07-24T03:00:53.261592Z","times_seen":964,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/favicon.svg","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:26.026Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\nage: 1266\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F8BDg8COUF%2BIKAzviRf7yqYc1DU6Kkyv0J6zfGQDQoXSHgY4KmwL2uj9EDf7zkLSVmmS8MDsQbhxsrP4Xts40zMpdD1vl1QJjWx%2FRfkF\"}]}\r\netag: W/\"65f5b2da-37c\"\r\ncontent-encoding: br\r\ncf-ray: 9c9db9cc7cac712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":892,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d9ee2d4b0edd9f8ba2fb7242162c2c47","sha1":"398522893cf2cdefb5176f11bc67eab31c2d7382","sha256":"a462f1c5333e16b48335054493cfd1d0a13a96847b4b9ffe2cf24403e6e86010","sha512":"e404678e96fe6f6d1fe6c1390e4a64d90844a2d8903f84f1a34b23137593da5ba04112d9504b8bf480b392b294830a363344c5767e3bb5b7a3cb6f5df2a3aa45","ssdeep":"","tlshash":"97114493d060e71ad4c9e16bef61fca0116720cee5b745d485d95a34500fcdbfc08668","first_seen":"2023-05-09T00:01:39Z","last_seen":"2026-07-24T03:00:53.185175Z","times_seen":15563,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"zws2.web.telegram.org/apiws","fqdn":"zws2.web.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.167.99","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:27.288Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.web.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Fri, 29 Aug 2025 16:48:47 GMT","end":"Wed, 30 Sep 2026 16:48:47 GMT"},"fingerprint":{"sha1":"AC:C6:BB:E5:EE:C9:DE:30:05:3E:F8:7A:06:97:90:26:97:A9:15:B3","sha256":"22:D2:01:7E:95:F5:70:BF:86:00:C5:9D:06:06:05:A1:5A:9C:96:BE:6B:EB:A6:1F:F2:A4:C3:A1:BC:5D:3D:E6"}}},"request":{"raw":"GET /apiws HTTP/1.1\r\nHost: zws2.web.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://qd1.zalandoa.net\r\nSec-WebSocket-Protocol: binary\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: Is/zxVlZIMveZKM73qiyIA==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nServer: nginx/1.18.0\r\nDate: Fri, 06 Feb 2026 21:26:28 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: +pN6LMMtO3+Mr94HkqbJc2/l/TA=\r\nSec-WebSocket-Protocol: binary\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T03:51:01.935142Z","times_seen":17492484,"resource_available":true,"data":null}},"time_used":2241,"timings":{"blocked":0,"dns":1080,"connect":1105,"send":0,"wait":25,"receive":1,"ssl":1111},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:25.909Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2 HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/main.4087993f942398d56511.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:25 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 11016\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\netag: \"65f5b2d6-2b08\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 1268\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LWa5F0Gk6uXlvz4p980qf3xzdX0Q9ISeayHYCADa8bUrbxcgYhBWXjMMBT5DELOt2i6kWJ2PhAx8qbc%2FRQbaRVaPIcbFkJVivesAdoy%2F\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cbec27712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11016,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11016, version 1.0","md5":"15fa3062f8929bd3b05fdca5259db412","sha1":"6ff06a34f68ad0324ddec1bbe4d453c959178b36","sha256":"5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479","sha512":"07e96d7520b4ede158e77bef10a01a33cd8be7d263fe6900f89c023e65e4a63570e8a442dec2e96030fb563b25610005a748d48f9330fd31eb91b37d1003d376","ssdeep":"192:Tysuo7z1NVoTUYAKVOO7YVxRwHQUXFI5xoBwH9f4d9QFmOfiS:TvdvVoTSjOYR4QUVIgBwpFLaS","tlshash":"6e32af8071ff1c50ff85c2f69be68efa2c2b1895c619016f5240b476397525e9c294bb","first_seen":"2023-04-05T09:25:54Z","last_seen":"2026-07-24T03:00:53.269121Z","times_seen":34434,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/icon-192x192.png","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:26.019Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /icon-192x192.png HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2da-bf3\"\r\nexpires: Sun, 08 Mar 2026 21:05:19 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1266\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nRMjs3Ye668VoIy3%2BWOoZnTtXi2GTHDcVotbmv59BJk6CSy22pGxdn3T9c2sw7mHMcKYV4vi%2FGvNCRyb5xGLx1QXthHyKY3sU1SeG%2FbN\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cc7cab712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3059,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit colormap, non-interlaced","md5":"1a1650d2c76bfc1ac484646c19e495b9","sha1":"fe58d66042ce9241226f5da9370230285ff604fc","sha256":"6e587a62c9d7a97f25265ab5eb29d101ad2e36810042a4116d2dd29da96b0bf8","sha512":"79c5c9278959bc94f66434779bebc1b46c055655f0bc58aa375f179c227e7ac0e52dea196764719d42aadcf98e4fd3b5a4488f2db977edde430aa3df733c03bc","ssdeep":"","tlshash":"bd514cd3253318e8e2dbfd7ace62041f656691ce5638ec120568de720c8985dc070caa","first_seen":"2023-05-16T22:57:55Z","last_seen":"2026-07-24T03:00:53.20345Z","times_seen":16521,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:26.083Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /4680.2d9cfefef59f5d86edec.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-2814\"\r\nexpires: Sat, 07 Feb 2026 09:05:17 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1268\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TCJYLaOK%2F3uy4Lx7oWrRJ%2BoB5OCRUHQ1XQ46w%2F33AyJV%2FDMk9IXzhuKcRRct77by2F4L%2BQTPdEe%2B44tZyaQiBT2aAVim3cjZcztIEa92\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cced01712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10260,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10206)","md5":"546e2512254f1abf3566e3413d69f034","sha1":"44596e4739dab279a46771809eb3d4a7216960f7","sha256":"542f89a1674a752e6edc50beb2aa66c92488b6084706e5f2d5e007123ea98348","sha512":"3998cc3d71f94ab39a4fad22093eb72266f82c515cce9a2777683c8faf718d26bd44390d17606211542eb91e986855ef6e98190b1ab4db4ad342d1b50a2b3f82","ssdeep":"192:+d05WVYG6G8UxYs1MlbKq2Y/WkFYmMWYW5zIf0hVetjFCfRCjkG6yScwLnhoK7RH:+1QUxYs1SdD/WkFYmMWYczTq5uCQGFS7","tlshash":"2a223bc03122783652936996a47f200374356b64784f9958721ddfea393bd8a7173ff1","first_seen":"2024-09-19T21:39:43.071073Z","last_seen":"2026-05-30T12:54:11.781398Z","times_seen":13,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/8415.070dfd3889c2a74f9cc0.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:26.091Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /8415.070dfd3889c2a74f9cc0.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 09 Feb 2025 03:12:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67a81d32-82241\"\r\nexpires: Sat, 07 Feb 2026 09:05:17 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1268\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MOSwfGVntMskePviuGvh90Un2rFtWG7Sl8%2BVro3N9guAJxe5aGPrAqkeWzSyRu2eKvQn%2BfV%2FV1MwRHPt43Wmpo60e05bzC7SUEmTupqx\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9ccfd06712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":533057,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65534), with no line terminators","md5":"be77480ce5081cbadcf6abbd782dc622","sha1":"1b75461345faa0f49da49e875f4cb3e4e82c74bc","sha256":"c1200a9441440334fe120326f5667b3829bf1d9dfa5a41d4628180d61af4e874","sha512":"89d7a37b6af66beb6b65313797f69be6554a9865bb2ac0e36bb07352c3504c121438d7ee75774c3540d7d15f8cb058c1cecf8094bbf221d6fedefb58250c55f2","ssdeep":"6144:+8d+PdaGwCULVlcloTOY2HqHUF0EBIF/gg9Du8JHwjL6tqm3VY:hd+Pda+UeY2KHU6EBI2ewP6sm3VY","tlshash":"c7b43cb37ff1662d5c5728c2b8a2724163b9c00961446078f5ed80ae1ab90cf57bbf6d","first_seen":"2025-11-01T13:54:56.5651Z","last_seen":"2026-05-30T12:54:11.800943Z","times_seen":12,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/main.4087993f942398d56511.css","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:25.750Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /main.4087993f942398d56511.css HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:25 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-1aab5\"\r\nexpires: Sat, 07 Feb 2026 09:05:15 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1270\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Du0rzjlIWJN1Yqe7x2Nvt6qePomA1orUsL1xSz0RXcHsZxwIPweBmi8eiYhZBYndnW2K9JciQJh6Bm0IaYDYMYq0X9tmWNVbdCHn1Dvt\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cadb5c712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":109237,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (11172)","md5":"4c9d3e2cef6cc643e5cd75aa4d099ff4","sha1":"98b0d570e4b6b5b3ec98667d826c052dadf92560","sha256":"09cca783b2738e3dacfc2bf7fb8dab72c2b1886924b2af42474a2c336819ce6d","sha512":"b35fbae5165f8e9f4bac21b4f564487a144d2403037b9e51b4a476d2ffa54ec1d89ddf3cdb8a3db80361b6bce7a8bacaa42ea8b8cdb0e2252190eba3619c1d98","ssdeep":"768:5gooAtqlPrvvDrbYiQyP2IgG72Rnoo9mb6Ub0JbAnEyJrkOsctfEEV+borlKf:5gxbY02IgGSGQbHS9f10","tlshash":"97b3f998e94411f96b23c23e97c4e76c9938e481de310fafb247655c07ca3eb11e2b59","first_seen":"2024-01-25T07:46:59Z","last_seen":"2026-05-30T12:54:11.803031Z","times_seen":181,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.324b1e6d0f5ae7c6ab42.woff2","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:25.937Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.324b1e6d0f5ae7c6ab42.woff2 HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/main.4087993f942398d56511.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:25 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 11056\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\netag: \"65f5b2d6-2b30\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 1268\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XeiZ7CjowGLRkDgdm%2B7sR1u6uYjSo5RDKzmbMhNaS0c1qb8BbeQVGL5ey%2FzwyDq7CTXSfO09elJXPoQ2uMvO40xvBh8tKbOxaQ%2BTjyHP\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cc0c41712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11056,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11056, version 1.0","md5":"07db243db21ed0a6b4ff05ff429686b7","sha1":"5d62925fdd7ed8e80f206d095ed093994f13d276","sha256":"ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e","sha512":"d34d15e91ba706886f7b098b5a42b3e31d374fda47d6e873f10b40fbea78d848921d124fc17045e77c432bcf2b4d4adfe5aeca4c3122cec199ac92e3124541ec","ssdeep":"192:duC8R1LnQKFt7DX2XFEu+zjdNr/ucPDf/Teifn/m1t7w9vxUBpZRCo++TkXT0R97:dL8bQKFt32XF/+zhNr/uS6i+tU9v6RCM","tlshash":"9d32bf0731ed12a1f9e8b3b1b9adc3490ce275f00bbc52da8669787ed43660e95d0078","first_seen":"2023-04-05T09:25:54Z","last_seen":"2026-07-24T03:00:53.302933Z","times_seen":7906,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/3748.0fa60c5a44d4b42a0115.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:25.964Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /3748.0fa60c5a44d4b42a0115.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:25 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-266a\"\r\nexpires: Sat, 07 Feb 2026 09:05:17 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1268\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7qoOkIh3kovJ0teAk9xkyX6lwNTDoD0W4CW0N991h9%2B%2FxW%2FdazEURzz5fPI56BHb89a%2FflHoryQXiDjJ%2F9QsYvmcJukaaHSt2zBxjVP%2B\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cc3c62712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9834,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9780)","md5":"02161e4617efa57e5c0ab5ae61300dcd","sha1":"bc99b5da6161b06d78a7f88119cd45f2dd826fbe","sha256":"46ff1f7377f83f6826433319f1a08efbebd39b4eef483c4924416a80df01a73c","sha512":"a0a0d04082edf186c5dffafa33cc7b97c4876d5d89f3909679ab76873325412fbd5579d8dee69308355e9eb33f9b02ace931413569389d49029cdfedfe68d7bd","ssdeep":"192:2Vcn1feShD/DSPaDamkt0M/YPAoDc+EuGsVczzS8W6DWAVYBB382c:2VIUS5/DSCGmkmMA7D/EuGsVgzSlkWMJ","tlshash":"9112e981b132747e626795c6e6084a03aa3591587c0da1bdf77c78fb2c9580b34bcf79","first_seen":"2024-01-25T07:46:59Z","last_seen":"2026-05-30T12:54:11.799578Z","times_seen":492,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:26.070Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /4680.2d9cfefef59f5d86edec.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-2814\"\r\nexpires: Sat, 07 Feb 2026 09:05:17 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1267\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0nNCeolDOD47wh%2BxRfKz%2BbZl6ZyKc4z22sfg7oyoM%2FeSA6N4MeuHAHur9hiYUkptP7fH7kGSvFUqwAw838Zj9PqgHLyDI9zc0lA%2F7Xqi\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9ccdcf4712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10260,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10206)","md5":"546e2512254f1abf3566e3413d69f034","sha1":"44596e4739dab279a46771809eb3d4a7216960f7","sha256":"542f89a1674a752e6edc50beb2aa66c92488b6084706e5f2d5e007123ea98348","sha512":"3998cc3d71f94ab39a4fad22093eb72266f82c515cce9a2777683c8faf718d26bd44390d17606211542eb91e986855ef6e98190b1ab4db4ad342d1b50a2b3f82","ssdeep":"192:+d05WVYG6G8UxYs1MlbKq2Y/WkFYmMWYW5zIf0hVetjFCfRCjkG6yScwLnhoK7RH:+1QUxYs1SdD/WkFYmMWYczTq5uCQGFS7","tlshash":"2a223bc03122783652936996a47f200374356b64784f9958721ddfea393bd8a7173ff1","first_seen":"2024-09-19T21:39:43.071073Z","last_seen":"2026-05-30T12:54:11.781398Z","times_seen":13,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/2041.5fe028b52e13d7a937b4.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","date":"2026-02-06T21:26:26.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /2041.5fe028b52e13d7a937b4.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-223ca\"\r\nexpires: Sat, 07 Feb 2026 09:05:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1266\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AdiS3eJiWz%2FZdQ%2BF0ukpBw1LGyFUNGEsRr9QTkqqItou0VwFNi%2FyvFNT%2FxeAHm6P8Lb9b2YNd3YHHOkodAXKSDrldCqI%2BCHfytF4ghQ9\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cd8d8e712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":140234,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"39c6ccbfd0be3bc43e412a138b4c9f89","sha1":"440310a69dfb81c245f3cfeb4014a001db4ca72a","sha256":"c16171043dbabab93f501b594c1a988e99b034cd39dc6c50b1809a47d64036a4","sha512":"162dbe8f7f7ea25168abb7f275f3c24ac85fdd9880b85cf4cb234afa1bd823360394fd98b7c65f84f2734b360f1ecb5ccff5d596a28abffd825b8069332b82a5","ssdeep":"1536:hW3M14X1jDx480MHyQL3YLZHZp+snJhcssuovxz2Rs1:IXxq8mwmJs9N","tlshash":"0bd3c682f86424125382b1e654760709773af41ca9c941acfe6cfed569bcd8d32afb34","first_seen":"2023-10-19T01:38:58Z","last_seen":"2026-05-30T12:54:11.786422Z","times_seen":499,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/blank.8dd283bceccca95a48d8.png","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:30.704Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /blank.8dd283bceccca95a48d8.png HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 68\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\netag: \"65f5b2d6-44\"\r\nexpires: Sun, 08 Mar 2026 21:05:25 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 1264\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f8894GMA3wuobSH6%2FuPhdYMWZsrE%2FnQ7yGUqUvXL0ugcvc5AFTL6XaxqVU0857ZVN4z0f%2Bof%2FDo7lcfd371wqLW2JKEn0Q13kAc94TMI\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9e9e973712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":68,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced","md5":"91e42db1c66c0b276abf6234dc50b2eb","sha1":"c1986af3c26609b8b7d8933f99c51c1a89e9ea6b","sha256":"63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058","sha512":"0b77019542fdb02f72c8407a379579bde36e2fe3af81b1c74553f1b5df2590373bf7e6ff3fefcbdaf0b9a2fcf9b1e57b30d24e29810f0cfaf9d51153415c89ce","ssdeep":"","tlshash":"bea022c223e0ec3cc38c8233c0000230f83000ab08000028202be0202e822e0088c2a2","first_seen":"2023-04-05T22:54:48Z","last_seen":"2026-07-24T02:49:51.712311Z","times_seen":35724,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/1915.7c097c4f98f78164d509.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:25.913Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /1915.7c097c4f98f78164d509.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:25 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-46da\"\r\nexpires: Sat, 07 Feb 2026 09:05:17 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1268\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=anbPB0YE8f%2Fe7G1LDhqkLb5YNJbviB16wW3XTI6TcIxQtv2bu00Y1M2D1%2FmBTgmiKRTjWajO7exvJsrYglI6YvI9b2VnEKlA32wrOjtE\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cbec2c712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18138,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (18078)","md5":"da88a8550ef58d5fed48f5d54f88ee08","sha1":"51fe5562057d56bfeda2d6bb6ed3ecb449cfd927","sha256":"207f18121e4a48210dd0aff08d57b1fb9af346a17e38d57d60be15a7f5c733f4","sha512":"7b692a2bca809aef1f70ea065592c62e447f0b4c5b3040c43dade1bac520d030467ec9bf1528e6be058c0e436dd0794d5129449461a6d18c2a263de7e4ac7cb1","ssdeep":"192:R/kF3DWtg5I3cTKk/Q4yZOXG/lB0wKqwztTSuIdmPignIi7SdibRs1YpZNWBvYAL:RI3Dbac/TW30J/tBROZXyEW0NZubU","tlshash":"5282e76bee110c2e02d351a7f9ca3106b5b982a6d2505470d36dd06f03ed8de367fb69","first_seen":"2024-01-25T07:46:59Z","last_seen":"2026-05-30T12:54:11.792184Z","times_seen":489,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/6839.01a53cbedf5d86d252ec.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:25.961Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /6839.01a53cbedf5d86d252ec.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:25 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-b2ba\"\r\nexpires: Sat, 07 Feb 2026 09:05:17 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1268\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U85AzHNSLvaqhOZwhRppl5Cb97FtDvxNJcxOhEkB%2FR50r8K0xho6FS%2B1OuAaSMt22NptL0bP7w76QY1I%2BDOx7hcdLHt%2FmH8zX%2Fl4T3s5\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cc2c5c712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45754,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (45662)","md5":"2075f46f0950d8614b73045505b7aafc","sha1":"34da1902bc42580deab249ac8ef5c4901d243a43","sha256":"f693fccbb0f64594079d492db05d3bced69a6c6cab7514d4b78733570fd592a1","sha512":"c86f9062cfe41a8cf4e7e2d3f5767c6b6ecb64aedabcca5e9dd67914bb914bc50d5cd93861f98817725b6309805c8598715e31eb3104978e40a0d9dfa734c88e","ssdeep":"768:Ee+ebTqPIHWzl/cIO4HI+ebv3djbql2cPg+bwTjhva4HASW:vb+PVzl/cIzdyw","tlshash":"8223e8a9b381a1b66a5695e3403b0447f138f6252816d06cf739c8de687cdc5b93bf38","first_seen":"2023-10-19T01:38:58Z","last_seen":"2026-05-30T12:54:11.777772Z","times_seen":652,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/5802.36a9971f58c808c4a974.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","date":"2026-02-06T21:26:26.126Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /5802.36a9971f58c808c4a974.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-541b\"\r\nexpires: Sat, 07 Feb 2026 09:05:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1267\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2VJlaC%2Br3dSnsUZXDEIaL2g%2FiGgcsHLDYBnfzcD9pf5Axi8aRcP%2F06uAL%2BePQBy6x8j27OJEib4XxW0pkKoaaewK8gzzl%2Bv2UL6rgOd1\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cd3d44712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21531,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (21394)","md5":"377d06c30eebd149e43e37a12f0bc3a6","sha1":"0bedfd302e5fc849518158b650612361fc160e99","sha256":"a6456f4285ecaf7f44d25cde45f56f6afefbb7fea2e36633e4bb4e0e5ebb8779","sha512":"d7a2c2a1f4be6213e9beee7784c0de04ee40c12986605940b27be9a1e6f2c31c0d15a61afa2c04ef67f7788cb09384f30a543973c70996c0d343d2676f596486","ssdeep":"384:yA3JV5i17HY+SWId88Q+0VL3oQ0LmVIkTzxr1mQ024BTQ2tp2BLRX8tRiWym:yA3JVMdHR8cVL3oQ0LeIkfT024BTQUYS","tlshash":"13a21bb766f915d652e848e808cb189951f4e0223d86293d5134fdd220f2cdbf2eb9bd","first_seen":"2023-10-19T01:38:58Z","last_seen":"2026-05-30T12:54:11.791508Z","times_seen":454,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/5802.36a9971f58c808c4a974.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","date":"2026-02-06T21:26:26.129Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /5802.36a9971f58c808c4a974.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-541b\"\r\nexpires: Sat, 07 Feb 2026 09:05:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1267\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FqpIfCLEqHiZl5cE0ouK2yVMcOay0%2Bxr7APS8f%2B4oE864c%2FacVvwuuvu8sq2yRAUAK30A9BnPr49D6ceBX8fN79UaXwErbKFYX7d0CuC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cd4d4e712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21531,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (21394)","md5":"377d06c30eebd149e43e37a12f0bc3a6","sha1":"0bedfd302e5fc849518158b650612361fc160e99","sha256":"a6456f4285ecaf7f44d25cde45f56f6afefbb7fea2e36633e4bb4e0e5ebb8779","sha512":"d7a2c2a1f4be6213e9beee7784c0de04ee40c12986605940b27be9a1e6f2c31c0d15a61afa2c04ef67f7788cb09384f30a543973c70996c0d343d2676f596486","ssdeep":"384:yA3JV5i17HY+SWId88Q+0VL3oQ0LmVIkTzxr1mQ024BTQ2tp2BLRX8tRiWym:yA3JVMdHR8cVL3oQ0LeIkfT024BTQUYS","tlshash":"13a21bb766f915d652e848e808cb189951f4e0223d86293d5134fdd220f2cdbf2eb9bd","first_seen":"2023-10-19T01:38:58Z","last_seen":"2026-05-30T12:54:11.791508Z","times_seen":454,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/5802.36a9971f58c808c4a974.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","date":"2026-02-06T21:26:26.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /5802.36a9971f58c808c4a974.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-541b\"\r\nexpires: Sat, 07 Feb 2026 09:05:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1267\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JijqpW0vDIvz8gDc5lF9A%2FCdEX9sfbsbG2S3glAYx9j77K6aevlGjoeTy6WuJbg6hS99v6CJ90XFXzIygPVIXnZ44lqugyLDzy7EJY5G\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cd4d50712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21531,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (21394)","md5":"377d06c30eebd149e43e37a12f0bc3a6","sha1":"0bedfd302e5fc849518158b650612361fc160e99","sha256":"a6456f4285ecaf7f44d25cde45f56f6afefbb7fea2e36633e4bb4e0e5ebb8779","sha512":"d7a2c2a1f4be6213e9beee7784c0de04ee40c12986605940b27be9a1e6f2c31c0d15a61afa2c04ef67f7788cb09384f30a543973c70996c0d343d2676f596486","ssdeep":"384:yA3JV5i17HY+SWId88Q+0VL3oQ0LmVIkTzxr1mQ024BTQ2tp2BLRX8tRiWym:yA3JVMdHR8cVL3oQ0LeIkfT024BTQUYS","tlshash":"13a21bb766f915d652e848e808cb189951f4e0223d86293d5134fdd220f2cdbf2eb9bd","first_seen":"2023-10-19T01:38:58Z","last_seen":"2026-05-30T12:54:11.791508Z","times_seen":454,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/5802.36a9971f58c808c4a974.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/8415.070dfd3889c2a74f9cc0.js","date":"2026-02-06T21:26:26.171Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /5802.36a9971f58c808c4a974.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/8415.070dfd3889c2a74f9cc0.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-541b\"\r\nexpires: Sat, 07 Feb 2026 09:05:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1267\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P9zs7Ohvb6QoIw9SQYLtOOzQRi1R6iqBwGT3XbYckOIT96jsBn2MP0CmKfoTVp5qYy3pLbrxEon64sN6xE7Jthj88toZEz3uSzXPtPPM\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cd8d82712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21531,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (21394)","md5":"377d06c30eebd149e43e37a12f0bc3a6","sha1":"0bedfd302e5fc849518158b650612361fc160e99","sha256":"a6456f4285ecaf7f44d25cde45f56f6afefbb7fea2e36633e4bb4e0e5ebb8779","sha512":"d7a2c2a1f4be6213e9beee7784c0de04ee40c12986605940b27be9a1e6f2c31c0d15a61afa2c04ef67f7788cb09384f30a543973c70996c0d343d2676f596486","ssdeep":"384:yA3JV5i17HY+SWId88Q+0VL3oQ0LmVIkTzxr1mQ024BTQ2tp2BLRX8tRiWym:yA3JVMdHR8cVL3oQ0LeIkfT024BTQUYS","tlshash":"13a21bb766f915d652e848e808cb189951f4e0223d86293d5134fdd220f2cdbf2eb9bd","first_seen":"2023-10-19T01:38:58Z","last_seen":"2026-05-30T12:54:11.791508Z","times_seen":454,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/rlottie-wasm.5e3833cedb8fb71c8d8e.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","date":"2026-02-06T21:26:26.218Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /rlottie-wasm.5e3833cedb8fb71c8d8e.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-1005e\"\r\nexpires: Sat, 07 Feb 2026 09:05:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1265\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DsCONxWcPuCoVSsucpLg0qc8nL9TTawJBJ4uy3ex%2F4zoWw8t7YhWWqFUGA5lyuq%2F2rfQlMJfMeAAraHKNTfWWhdqwS%2FyTj1ze9rxd%2Fb0\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cdddb7712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65630,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"3559b2b89d032ebe64593c61c4ce75a0","sha1":"0f6cb82095dfedfff7a1eb3d320e6c991ff5f479","sha256":"8524c2222885bf761b5f366d8e1d465a668f7061f8fcc2f01250d446b2dc554a","sha512":"ea3bce8c1fc2cc640dae469ba6f6f01f1708999f5a6c3dfece28571b7292b81b435073b62e5ea7169c00d00bb8c1eb1c83fa878c215d0455a6db0d0a53e16aae","ssdeep":"768:O6T4cchKQ6eO1P2Wgcdxazvs5X0gBBqfRna76Ae/FqsSwYTRrqhlr3NqR:oMQ6eO4+IU5XYxjvq1alrcR","tlshash":"e353e88535d9b0ab42833878946f314bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2023-09-16T03:06:02Z","last_seen":"2026-05-30T12:54:11.794414Z","times_seen":575,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"qd1.zalandoa.net/rlottie-wasm.5e3833cedb8fb71c8d8e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/compatTest.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:25.744Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /compatTest.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:25 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Fri, 07 Feb 2025 07:21:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67a5b460-4cf\"\r\nexpires: Sat, 07 Feb 2026 09:05:15 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1270\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=876A0Rm2vC7%2F%2B6b6nh5MiWThCI2kMH9LQBu4Yseb2qMYaEUtr3rwPhBxNYpvxDnCVRLUsthv9GAi3ZJfNx%2F3bHO9mtnMG3CvwLVjMFLH\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cadb59712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1231,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"6cd5af9f25450b853670937767d78567","sha1":"64e00d45abe2aa9be5de3a0d0f654a11615104c6","sha256":"61b532b735c7efb7b45fb4c702583f2825a8f505d65af68c06acbd60a0018d1c","sha512":"5c93a87f67c7cbaec11c169d636fbf7bf4316c58554415f9098e38086b2d0ae692c52c99827584cf2452f53e829748d0e8164d221c6de25b4bd7dd813bc4b82d","ssdeep":"","tlshash":"7621d5195cf162a1907524653b1bb046b529d132891cfea4f2608f787fe2d5b434fcf5","first_seen":"2025-11-01T13:54:56.560427Z","last_seen":"2026-05-30T12:54:11.796957Z","times_seen":12,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:26.079Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /4680.2d9cfefef59f5d86edec.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-2814\"\r\nexpires: Sat, 07 Feb 2026 09:05:17 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1268\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UtfDiksAT6crF%2FgdXHvubHYCksqVtjl5%2FOFmA8vtw6cHazYMJZTqFg3PjON29NnvS6tWzuu3kQydoBzeHtODRDfJzWSSQXywxFVGl%2Fuq\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cced00712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10260,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10206)","md5":"546e2512254f1abf3566e3413d69f034","sha1":"44596e4739dab279a46771809eb3d4a7216960f7","sha256":"542f89a1674a752e6edc50beb2aa66c92488b6084706e5f2d5e007123ea98348","sha512":"3998cc3d71f94ab39a4fad22093eb72266f82c515cce9a2777683c8faf718d26bd44390d17606211542eb91e986855ef6e98190b1ab4db4ad342d1b50a2b3f82","ssdeep":"192:+d05WVYG6G8UxYs1MlbKq2Y/WkFYmMWYW5zIf0hVetjFCfRCjkG6yScwLnhoK7RH:+1QUxYs1SdD/WkFYmMWYczTq5uCQGFS7","tlshash":"2a223bc03122783652936996a47f200374356b64784f9958721ddfea393bd8a7173ff1","first_seen":"2024-09-19T21:39:43.071073Z","last_seen":"2026-05-30T12:54:11.781398Z","times_seen":13,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/5802.36a9971f58c808c4a974.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","date":"2026-02-06T21:26:26.135Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /5802.36a9971f58c808c4a974.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-541b\"\r\nexpires: Sat, 07 Feb 2026 09:05:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1267\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QX%2FA%2FsYMQUby11sWXrvpv2lPCjuGOLDh8HyASNgUO8oW3ge1NSZaCpvsmPwSXiSpYY3%2BV6wu71XT%2BuAFTi3HDDV0Uvs%2FkznYRAV3rZAH\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cd4d56712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21531,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (21394)","md5":"377d06c30eebd149e43e37a12f0bc3a6","sha1":"0bedfd302e5fc849518158b650612361fc160e99","sha256":"a6456f4285ecaf7f44d25cde45f56f6afefbb7fea2e36633e4bb4e0e5ebb8779","sha512":"d7a2c2a1f4be6213e9beee7784c0de04ee40c12986605940b27be9a1e6f2c31c0d15a61afa2c04ef67f7788cb09384f30a543973c70996c0d343d2676f596486","ssdeep":"384:yA3JV5i17HY+SWId88Q+0VL3oQ0LmVIkTzxr1mQ024BTQ2tp2BLRX8tRiWym:yA3JVMdHR8cVL3oQ0LeIkfT024BTQUYS","tlshash":"13a21bb766f915d652e848e808cb189951f4e0223d86293d5134fdd220f2cdbf2eb9bd","first_seen":"2023-10-19T01:38:58Z","last_seen":"2026-05-30T12:54:11.791508Z","times_seen":454,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/2041.5fe028b52e13d7a937b4.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","date":"2026-02-06T21:26:26.175Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /2041.5fe028b52e13d7a937b4.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-223ca\"\r\nexpires: Sat, 07 Feb 2026 09:05:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1266\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y%2Flw7TbzjIQBU0rAKK25ZXmh3l%2BTrGpHu9j3JMn91UEETCf8vxY4WNStUvCaKoX8oHOpnqRncVleufWiNHLC4ItRYQMFm1NGJyUl1hlG\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cd8d8a712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":140234,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"39c6ccbfd0be3bc43e412a138b4c9f89","sha1":"440310a69dfb81c245f3cfeb4014a001db4ca72a","sha256":"c16171043dbabab93f501b594c1a988e99b034cd39dc6c50b1809a47d64036a4","sha512":"162dbe8f7f7ea25168abb7f275f3c24ac85fdd9880b85cf4cb234afa1bd823360394fd98b7c65f84f2734b360f1ecb5ccff5d596a28abffd825b8069332b82a5","ssdeep":"1536:hW3M14X1jDx480MHyQL3YLZHZp+snJhcssuovxz2Rs1:IXxq8mwmJs9N","tlshash":"0bd3c682f86424125382b1e654760709773af41ca9c941acfe6cfed569bcd8d32afb34","first_seen":"2023-10-19T01:38:58Z","last_seen":"2026-05-30T12:54:11.786422Z","times_seen":499,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/2041.5fe028b52e13d7a937b4.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js","date":"2026-02-06T21:26:26.184Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /2041.5fe028b52e13d7a937b4.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/4680.2d9cfefef59f5d86edec.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-223ca\"\r\nexpires: Sat, 07 Feb 2026 09:05:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1266\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FZ2cRp8xfSH7KDlYuQUi%2Fo4%2BiLugCBiL7r1MKVMxBFk9sXNx10q67SYI0IRKVOQaMUZLk29Hc%2FgT1jKq7XQpL3N1PlJ2YpczHrUqvzsg\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cd9d92712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":140234,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"39c6ccbfd0be3bc43e412a138b4c9f89","sha1":"440310a69dfb81c245f3cfeb4014a001db4ca72a","sha256":"c16171043dbabab93f501b594c1a988e99b034cd39dc6c50b1809a47d64036a4","sha512":"162dbe8f7f7ea25168abb7f275f3c24ac85fdd9880b85cf4cb234afa1bd823360394fd98b7c65f84f2734b360f1ecb5ccff5d596a28abffd825b8069332b82a5","ssdeep":"1536:hW3M14X1jDx480MHyQL3YLZHZp+snJhcssuovxz2Rs1:IXxq8mwmJs9N","tlshash":"0bd3c682f86424125382b1e654760709773af41ca9c941acfe6cfed569bcd8d32afb34","first_seen":"2023-10-19T01:38:58Z","last_seen":"2026-05-30T12:54:11.786422Z","times_seen":499,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/redirect.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/","date":"2026-02-06T21:26:25.746Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /redirect.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:25 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:22 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Sat, 07 Feb 2026 09:05:15 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\nage: 1270\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1VNWYmjOvNohCEAidkA2Bj6CuD%2BBUZMMTCRvc2HzITxOz4CBJUdVWH8t0CqhWn4lW8N8V3mB3xCvSwnxyjJZE39U5E4t9bKVm8hiN1Mk\"}]}\r\netag: W/\"65f5b2da-145\"\r\ncontent-encoding: br\r\ncf-ray: 9c9db9cadb5a712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":325,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"17773b57b87a678c98e26a7cac72df6c","sha1":"7422857aa75ee81cabcec2eed6c4a6168f363ee1","sha256":"375141f2d3f04c733276dbff5d9208ff36b2db6a64abcee723179ac24797974f","sha512":"28d9e1c2af08154e653e2291db46f4110edbf9f5591192f8d695c8852f9c3c755d69dfb5a032a45f51e0a3fc9417f16c20d0772b1225ca9b85e5531e12fa8bfc","ssdeep":"","tlshash":"e8e07dda0279030417e013f36d82b4709137c2fb604c5d028d984321a1b9b4f5b7b84f","first_seen":"2023-07-27T09:32:34Z","last_seen":"2026-07-20T07:32:01.79149Z","times_seen":11535,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qd1.zalandoa.net/8764.58763b7a689318950e51.js","fqdn":"qd1.zalandoa.net","domain":"zalandoa.net","tld":"net"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qd1.zalandoa.net/8415.070dfd3889c2a74f9cc0.js","date":"2026-02-06T21:26:26.215Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zalandoa.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 01 Jan 2026 12:02:52 GMT","end":"Wed, 01 Apr 2026 13:01:26 GMT"},"fingerprint":{"sha1":"89:CE:A1:FE:CA:7C:32:CD:98:98:60:E9:29:4A:52:26:6F:9E:36:1B","sha256":"87:F5:0B:F6:11:1C:F5:84:A7:18:46:0B:F8:7F:4E:70:4D:56:0D:C4:07:3E:C9:E7:9F:D8:B5:4B:BD:AF:1D:68"}}},"request":{"raw":"GET /8764.58763b7a689318950e51.js HTTP/1.1\r\nHost: qd1.zalandoa.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qd1.zalandoa.net/8415.070dfd3889c2a74f9cc0.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Fri, 06 Feb 2026 21:26:26 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sat, 16 Mar 2024 14:55:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65f5b2d6-6b32\"\r\nexpires: Sat, 07 Feb 2026 09:05:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 1267\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZN6xpEclLQuojw3%2F0z5%2Bxn6MjPdCzEq6NmlGRxd8ZOXX6hYYyXhU25QCmJXYJYmPttPAQ3SE0ZNuwZrL0kcH46CknGZN45Sl%2BhtpDgdV\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c9db9cdcdb4712b-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27442,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (27305)","md5":"0198d988a3400c6f4abdcd15352e954d","sha1":"27b573f135096fc85ce78ddd2dae6071de71bcd5","sha256":"b38c94050169465563c915a3ca347af2cbf5cb981995a5bc3bc88b5cfe017ba9","sha512":"03d1248feba8fa2d7f3031b184a4ee025685d698a923efcd70bcd7ed58ff244306b4ac36d09cd319a13ad2aca9c6613f1a54cf2185f6dd79fb41b012f6c89492","ssdeep":"768:owtqo27ZC/rMqRvxFsqfmdSwTRvzBobGsT3ZT3GiYl2T3yT3TJVcUWA7h5D1fRyj:JHVeLBoCEl/KrdfO","tlshash":"50c28584b7a5b07603636691046b541bf279ee28b44c58acf250e4f328b78da94fff74","first_seen":"2023-10-19T01:38:58Z","last_seen":"2026-05-30T12:54:11.801613Z","times_seen":600,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"qd1.zalandoa.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}