{"report_id":"44c4f4ce-7b99-4aa2-a253-9e5e74fd1f82","version":6,"status":"done","tags":[],"date":"2026-01-24T13:55:18Z","url":{"schema":"https","addr":"check-lighter.xyz/","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"ip":{"addr":"172.67.194.45","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"check-lighter.xyz/","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"title":"Lighter","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T05:04:45.144132Z","times_seen":17913392,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"check-lighter.xyz/","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"ip":{"addr":"172.67.194.45","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-28T13:55:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"check-lighter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"check-lighter.xyz","ip":{"addr":"104.21.84.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-12-30","domain_rank":0,"first_seen":"2026-01-24T13:41:42.697704Z","last_seen":"2026-01-24T13:41:42.697704Z","alert_count":9,"request_count":9,"received_data":10682710,"sent_data":4289,"comment":"","tags":null,"fingerprints":[{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Framer Sites","description":"Framer is a no-code web design platform for designing and publishing responsive websites.","website":"https://www.framer.com","common_platform_enumeration":"","icon":"Framer Sites.svg","categories":["CMS","Page builders"]}]},{"fqdn":"framerusercontent.com","ip":{"addr":"65.9.86.70","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2019-04-29","domain_rank":18507,"first_seen":"2019-05-01T19:48:10Z","last_seen":"2026-01-21T12:44:50.797493Z","alert_count":0,"request_count":3,"received_data":58149,"sent_data":1557,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-01-18T22:14:28.232245Z","alert_count":0,"request_count":3,"received_data":96609,"sent_data":1617,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"check-lighter.xyz/orion.js","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"ip":{"addr":"104.21.84.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4ef784c5f77fd85a3faf1aced393f438","sha1":"7d56a9e40e763f22051cffd86dfee583d6c4affe","sha256":"ab3c953f398dbf5a37fba7164faf9a2a13f7870ca9d88869456946d6c900e6fa","sha512":"06cbc54a5d338c3d4405099cab32324a9f0cede4df6ccece9800f382e691c60fba9096939a324c6bcad984dd676fa7a62ca52f29b69360ff2703e8a02c24f062","ssdeep":"768:MGhL9c6PhJQaginy+8NhdhxWI68EHjWUGUCKeMcijODHcrsqYUJ4izlKc6mls5gB:LhQina7dPWI68EHJ6KaA3nlTRKQmi","tlshash":"1a8341da590bd0d68e5210ced477fc09e4680963cdacf1a3aa6cddc6b45ef62844723b","size":85337,"data":"","first_seen":"2025-12-31T16:20:29.545264Z","last_seen":"2026-02-22T23:08:24.35442Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"check-lighter.xyz/","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"ip":{"addr":"104.21.84.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ad4caa5e0e174e81d4f5195038e35b24","sha1":"ee5455d21e18ae23683a61dbb1900ea60440f681","sha256":"48b18c42c62d2144e0878b69c0e1e4b946006e5795d3c429427bbdf6c7e37cf8","sha512":"ba196695fdc470121755ca9d8bc8e83c0db8a7e73e4f2579782c9bb309335192664895658d0c762d8b2ff5941e0e16b222a2718f8e7c9f86b0d7c310a332f00c","ssdeep":"","tlshash":"89e0120d80a25903907b39a53a87713525e610bb3849cd193b4c9ad07f37b5ac5579dd","size":316,"data":"","first_seen":"2026-01-21T11:29:52.699577Z","last_seen":"2026-03-10T10:43:21.624905Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"check-lighter.xyz/","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"ip":{"addr":"104.21.84.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"28633931a8fe317e17a243486c27f20d","sha1":"b59183e94b7ea6d4fa0a7d52053b1aea81a0c4e6","sha256":"2795a6440e4d391a65885a28da0fb29c3ee633bb9f0fce4a516318a72104f290","sha512":"6127d2a48b8ba706153b34ce7ff3a99cb3b7a7ebbf627d492e0f8f37e6fe56e80190a5dacc5308d2301ea86bccc100f318588f06e81ffaefced46870235890d7","ssdeep":"768:9uhLtc0f9psasVbGoy7pM5vRjVUjIL/cJCqYUJ4izVIc6ETsbccQcAcUcjc9cycD:M9yGbe33sdtThRK8s9","tlshash":"3f8360d9a91bd0d58e5220ced477e809e4280963cdacf1a3b92ceed1745df62c44b27b","size":82248,"data":"","first_seen":"2025-12-31T16:20:29.60055Z","last_seen":"2026-02-22T23:08:24.40305Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"check-lighter.xyz/","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"ip":{"addr":"104.21.84.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-24T13:54:46.094Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"check-lighter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 10:19:19 GMT","end":"Mon, 30 Mar 2026 11:17:46 GMT"},"fingerprint":{"sha1":"4E:9F:22:1B:17:8B:3B:7C:13:D6:47:3B:CE:98:81:39:93:EB:AF:FB","sha256":"06:F1:59:CB:DE:D7:56:37:7F:E2:AB:C7:59:E4:6B:E3:1D:11:3C:19:50:71:2C:CA:D1:91:D1:AA:89:BA:02:4B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: check-lighter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 24 Jan 2026 13:54:46 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 30 Dec 2025 10:45:27 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nR7tuRuSllBLfgFexzPv2p2Jl8PJS%2FN3tBNdqrr%2BX6B606GnyCDMw6la%2FZhxjEhh%2Bw97DZIWKBRLIeyxkQCPLGXujK9vfc96dbyt6hAaFw%3D%3D\"}]}\r\nage: 811\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9c30064e4e005684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Framer Sites","description":"Framer is a no-code web design platform for designing and publishing responsive websites.","website":"https://www.framer.com","common_platform_enumeration":"","icon":"Framer Sites.svg","categories":["CMS","Page builders"]}],"data":{"size":1290905,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (53268)","md5":"ca0086204098aa94df89e9ab94222ccf","sha1":"a46dbf7288c66992b7e5417e0a5690832fa4c302","sha256":"6b1213e159760b5440fae66a093b57ead8d939914f2e36eae0491036a59eab5b","sha512":"4d94218f0acdb6380579df8656f6930518182e4974b0a5e68be62e0849da8a6ef5a0d9ee498193be4f46539a23064c263e170ccc5cb960ad6c428e7c847d6922","ssdeep":"3072:uCL5QUti65z565g5QpwTfpECtzH4dJJMQ5bObEhYSmI0hng:HHtitkzH4d3n/hYSmIMng","tlshash":"af25bd33a282927d19c781aef591964c37ad5706ff33415ab2a6207ff38cad168607dc","first_seen":"2026-01-21T11:29:52.69854Z","last_seen":"2026-02-22T23:08:24.329536Z","times_seen":6,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":29,"dns":6,"connect":1,"send":0,"wait":35,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"check-lighter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"framerusercontent.com/assets/bHYNJqzTyl2lqvmMiRRS6Y16Es.woff2","fqdn":"framerusercontent.com","domain":"framerusercontent.com","tld":"com"},"ip":{"addr":"65.9.86.70","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://check-lighter.xyz/","date":"2026-01-24T13:54:46.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"framerusercontent.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Thu, 16 Oct 2025 00:00:00 GMT","end":"Fri, 13 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"31:EF:AE:14:9A:1C:B7:8C:AB:DF:01:C0:39:9E:AE:49:90:E5:84:94","sha256":"B7:E9:B0:B0:73:ED:29:A4:09:64:FA:77:EF:60:53:32:51:10:08:95:FD:7B:4A:69:60:51:6D:9F:AF:31:9D:5E"}}},"request":{"raw":"GET /assets/bHYNJqzTyl2lqvmMiRRS6Y16Es.woff2 HTTP/1.1\r\nHost: framerusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://check-lighter.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check-lighter.xyz/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: CloudFront\r\ncontent-type: font/woff2\r\ncontent-length: 26588\r\ndate: Sat, 03 Jan 2026 21:43:38 GMT\r\nlast-modified: Tue, 12 Aug 2025 12:47:52 GMT\r\netag: \"ed808fc28d4461bab9b6a57a6ff28b85\"\r\naccept-ranges: bytes\r\ncross-origin-resource-policy: cross-origin\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000, immutable\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 3108b3c3c306768051fa0658c0445308.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: AMS1-C1\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-amz-cf-id: NImL2yJ874R7Ex1YPHmcvwGbI603jzUxHfws645e7Pr1QrBUMMdSEQ==\r\nage: 1786270\r\ntiming-allow-origin: *\r\nserver-timing: cdn-cache-hit,cdn-pop;desc=\"AMS1-C1\",cdn-rid;desc=\"NImL2yJ874R7Ex1YPHmcvwGbI603jzUxHfws645e7Pr1QrBUMMdSEQ==\",cdn-hit-layer;desc=\"EDGE\",cdn-downstream-fbl;dur=5\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":26588,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 26588, version 4.0","md5":"5ec39af341bf1da2b96d84178afc3cf4","sha1":"6c760d26acd3ca5da5aaffe63224514ba635e84b","sha256":"b68a1d9dd28ee2271e335f0641317ae656016451ccac2a6eb30abf74009cef4c","sha512":"874787d3ad800113541224ab5a9f2ad645ccb2644d4e9c543c2b925c28f7efd80d8e80395e18ab6b24add206e6e3c550e2525acda689f405103935bc5a7fb4c4","ssdeep":"768:+vdRIjKRd/BS5njhBD/mkc76qWHEWSekWrgCOejUn8ONbL:jKROVZOkcGHmekCNQ8ON","tlshash":"4ec2f145c3ca9407db163530c1dfe231bf32a7c8cba89ccb76996a7d260552db2443b8","first_seen":"2025-09-04T17:15:58.142383Z","last_seen":"2026-08-15T04:53:45.341049Z","times_seen":239,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":65,"dns":1,"connect":18,"send":0,"wait":43,"receive":9,"ssl":40},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"check-lighter.xyz/hero.webm","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"ip":{"addr":"104.21.84.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://check-lighter.xyz/","date":"2026-01-24T13:54:47.244Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"check-lighter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 10:19:19 GMT","end":"Mon, 30 Mar 2026 11:17:46 GMT"},"fingerprint":{"sha1":"4E:9F:22:1B:17:8B:3B:7C:13:D6:47:3B:CE:98:81:39:93:EB:AF:FB","sha256":"06:F1:59:CB:DE:D7:56:37:7F:E2:AB:C7:59:E4:6B:E3:1D:11:3C:19:50:71:2C:CA:D1:91:D1:AA:89:BA:02:4B"}}},"request":{"raw":"GET /hero.webm HTTP/1.1\r\nHost: check-lighter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check-lighter.xyz/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 13:54:47 GMT\r\ncontent-type: video/webm\r\ncontent-length: 3829654\r\ncast-mode: default\r\nlast-modified: Tue, 30 Dec 2025 10:45:27 GMT\r\netag: \"6953ad47-3a6f96\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 811\r\ncontent-range: bytes 0-3829653/3829654\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kyiVpK7n4gaw4eoUWL25Olb%2F5eI%2BqTMRYrrcb2u%2B2i0Fb3IfGX5MHjOA3iihRrzSAhjn6%2BXqD%2FUc5ARdG1FiRclsy8Z4JXwm5ekZzxbTZg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9c3006554e8ab51e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3829654,"size_decoded":0,"mime_type":"video/webm","magic":"WebM","md5":"ee463ee327a8fa1d709d139dba80303c","sha1":"bf4f98e2e766d8a4704d8159e8dbc2d3c0c2ef9f","sha256":"b7d093bf8b553e6d345db3ce80c1a3bb67236d5c3acd1809056825c2a35314e0","sha512":"9b1bf57e12688a18ba76b56a5721494474be6a026f03ed541432b3f08b1f0b03fec3e96b9299cded1cf5a00679ff2a954dbc839d395f429e99c14f7b6946f394","ssdeep":"24576:W8o9hpRYaYRd95Nhkc9E4OfTgQ7tCVw1fZyKyE7ftfpbmmOLwYBB:WjhpRxW95NhXOfTRtQ2ymXSLDB","tlshash":"c52523d6f829b5c7d264cd7dce231c04565a868a38a07e58f8db9b52c4be206dfce407","first_seen":"2025-11-27T21:37:46.556819Z","last_seen":"2026-08-15T18:44:34.297918Z","times_seen":43,"resource_available":false,"data":null}},"time_used":591,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":31,"receive":560,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"check-lighter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"check-lighter.xyz/secureproxy?e=jscdn/getFile","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"ip":{"addr":"104.21.84.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://check-lighter.xyz/","date":"2026-01-24T13:54:47.614Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"check-lighter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 10:19:19 GMT","end":"Mon, 30 Mar 2026 11:17:46 GMT"},"fingerprint":{"sha1":"4E:9F:22:1B:17:8B:3B:7C:13:D6:47:3B:CE:98:81:39:93:EB:AF:FB","sha256":"06:F1:59:CB:DE:D7:56:37:7F:E2:AB:C7:59:E4:6B:E3:1D:11:3C:19:50:71:2C:CA:D1:91:D1:AA:89:BA:02:4B"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: check-lighter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://check-lighter.xyz/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://check-lighter.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"hucjxxxamlrkzv2nf47v\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 13:54:48 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7nGtENkAXzCQHu4CAd%2FJGr1D%2F1E7AuS9YQ%2FuBEqd7JERH3vv1y9GvLPIUZpkRWyNBmrfdB3KuB4EfjYyuvSGlNBhaODnlpYOY6Rjmc3N%2BazkyA%3D%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\ncf-ray: 9c3006590ec0b51e-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5281574,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"1fe00c493bcd896235c239dcaf303f91","sha1":"7d28c934a8a7aab08d24ccf93173838c342593e0","sha256":"c6cded67f6a5e9bb326cb7f280b7520e69b63afe588fd766a0e4e27e2752e6ba","sha512":"c47f527e8b6e829dd031d89ab8e5b8066ef8b6df99d5e2a9dd9a67e4557b267e5dd93ddfffeb3af4a3c3f9313522f4f25b65ae6052ff40511b0568370bfa1153","ssdeep":"24576:F/OvYiQUmD/WMmOHrA2vjY8ASERC4iTdSUr:F/O7WxrAojYtdR+5r","tlshash":"ff2512ebe066b0d32b219878b5d12dde799f90ac65c247f72854ec5462ca03ec4dcbd2","first_seen":"2026-01-24T13:41:45.971379Z","last_seen":"2026-01-24T13:55:20.177934Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1304,"timings":{"blocked":224,"dns":0,"connect":0,"send":0,"wait":319,"receive":761,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"check-lighter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"check-lighter.xyz/k22lnUP5Ao1xIheAoknaPGmdjXk.svg","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"ip":{"addr":"104.21.84.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://check-lighter.xyz/","date":"2026-01-24T13:54:46.365Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"check-lighter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 10:19:19 GMT","end":"Mon, 30 Mar 2026 11:17:46 GMT"},"fingerprint":{"sha1":"4E:9F:22:1B:17:8B:3B:7C:13:D6:47:3B:CE:98:81:39:93:EB:AF:FB","sha256":"06:F1:59:CB:DE:D7:56:37:7F:E2:AB:C7:59:E4:6B:E3:1D:11:3C:19:50:71:2C:CA:D1:91:D1:AA:89:BA:02:4B"}}},"request":{"raw":"GET /k22lnUP5Ao1xIheAoknaPGmdjXk.svg HTTP/1.1\r\nHost: check-lighter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check-lighter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 13:54:46 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Tue, 30 Dec 2025 10:45:26 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\nage: 811\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\netag: W/\"6953ad46-1f1\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BznYuk66zUahEz%2F0MVUykL3ogcLk3y2hSl%2FVWy3WFd0rZflRwIHRwp2IWXAO6SPLlVpWomxzxwxbT1qFC69i%2BsaFNoRUrLbe924tJiL8rQ%3D%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c30064fce55b51e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":497,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2004f556befdbc68ea6555b4c33b9e03","sha1":"936da59d43f9028d71221780a249da3c699d8d79","sha256":"82053f8420224ea019b5b01dd0b810b813aba8eb31b77f55699c7e9a54fa7abe","sha512":"f042948875296bb486c2f77b5f955f4b7b37b64bd2332d7dfcabe80d7763ce2bbae7775fe67068debaa560cab8f39b6ca1a0c0e2ef5e18a3f33b36b8ba325156","ssdeep":"","tlshash":"80f0e2f2a1f4d20a0f9443986b7c72ca0032308e514e06ddb0c8336ca95e36a2a41721","first_seen":"2025-11-20T11:15:14.622252Z","last_seen":"2026-03-28T01:16:36.048607Z","times_seen":50,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"check-lighter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"check-lighter.xyz/orion.js","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"ip":{"addr":"104.21.84.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://check-lighter.xyz/","date":"2026-01-24T13:54:46.362Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"check-lighter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 10:19:19 GMT","end":"Mon, 30 Mar 2026 11:17:46 GMT"},"fingerprint":{"sha1":"4E:9F:22:1B:17:8B:3B:7C:13:D6:47:3B:CE:98:81:39:93:EB:AF:FB","sha256":"06:F1:59:CB:DE:D7:56:37:7F:E2:AB:C7:59:E4:6B:E3:1D:11:3C:19:50:71:2C:CA:D1:91:D1:AA:89:BA:02:4B"}}},"request":{"raw":"GET /orion.js HTTP/1.1\r\nHost: check-lighter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check-lighter.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 13:54:46 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Tue, 30 Dec 2025 10:45:26 GMT\r\netag: W/\"6953ad46-14d59\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nage: 811\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lU7GlfXQQ8eK44ggcH9JiyEFc4ggnCROmU1rXCFIBdllCogDpXimDK%2FON9z8L9Uicr0i5nUuacADq%2FivP0z9%2FLnCpZ0tQXLmBtk1b9wwsw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c30064fce54b51e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":85337,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4ef784c5f77fd85a3faf1aced393f438","sha1":"7d56a9e40e763f22051cffd86dfee583d6c4affe","sha256":"ab3c953f398dbf5a37fba7164faf9a2a13f7870ca9d88869456946d6c900e6fa","sha512":"06cbc54a5d338c3d4405099cab32324a9f0cede4df6ccece9800f382e691c60fba9096939a324c6bcad984dd676fa7a62ca52f29b69360ff2703e8a02c24f062","ssdeep":"768:MGhL9c6PhJQaginy+8NhdhxWI68EHjWUGUCKeMcijODHcrsqYUJ4izlKc6mls5gB:LhQina7dPWI68EHJ6KaA3nlTRKQmi","tlshash":"1a8341da590bd0d68e5210ced477fc09e4680963cdacf1a3aa6cddc6b45ef62844723b","first_seen":"2025-12-31T16:20:29.545264Z","last_seen":"2026-02-22T23:08:24.35442Z","times_seen":13,"resource_available":true,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"check-lighter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"check-lighter.xyz/zkZcqLYKrbf3IcoLGmkQF4odXvY.svg","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"ip":{"addr":"104.21.84.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://check-lighter.xyz/","date":"2026-01-24T13:54:46.728Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"check-lighter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 10:19:19 GMT","end":"Mon, 30 Mar 2026 11:17:46 GMT"},"fingerprint":{"sha1":"4E:9F:22:1B:17:8B:3B:7C:13:D6:47:3B:CE:98:81:39:93:EB:AF:FB","sha256":"06:F1:59:CB:DE:D7:56:37:7F:E2:AB:C7:59:E4:6B:E3:1D:11:3C:19:50:71:2C:CA:D1:91:D1:AA:89:BA:02:4B"}}},"request":{"raw":"GET /zkZcqLYKrbf3IcoLGmkQF4odXvY.svg HTTP/1.1\r\nHost: check-lighter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check-lighter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 13:54:46 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Tue, 30 Dec 2025 10:45:26 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\nage: 811\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\netag: W/\"6953ad46-f4\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=A5mkeuJvW1mrzW9%2BgQYvAd%2F0XvU9yLX6MHPWUroBoJSmwXdNjNtkJMtn1r97REUNlHudAwFk%2BRilhOYqFmL0wSVsoyklC8q8Necy3hytQg%3D%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c3006521e69b51e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":244,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"99a94a88141573d428d82cc50c430003","sha1":"ce465ca8b60aadb7f721ca0b1a6910178a1d5ef6","sha256":"27a7910c07049dcccee58bae0dba917b8a0ab814ca7d2a6090eff76c80dd14e0","sha512":"7104c6954fafcca14c97ca8910d2ae7002878290fb9b28edc6059a485fd62a7b1c923ecfac27e13a3213a91501ebd57da1111fed291a1bc300cdabe0659d61e8","ssdeep":"","tlshash":"9bd09568415c040455118360dfec37e4705ff017c205116cb146683c530945f3c26959","first_seen":"2025-11-20T11:15:14.640883Z","last_seen":"2026-08-07T21:49:41.297102Z","times_seen":66,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"check-lighter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"framerusercontent.com/images/uTdLWjhUvfSiBaN37kYNLsUu4.png","fqdn":"framerusercontent.com","domain":"framerusercontent.com","tld":"com"},"ip":{"addr":"65.9.86.70","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://check-lighter.xyz/","date":"2026-01-24T13:54:47.489Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"framerusercontent.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Thu, 16 Oct 2025 00:00:00 GMT","end":"Fri, 13 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"31:EF:AE:14:9A:1C:B7:8C:AB:DF:01:C0:39:9E:AE:49:90:E5:84:94","sha256":"B7:E9:B0:B0:73:ED:29:A4:09:64:FA:77:EF:60:53:32:51:10:08:95:FD:7B:4A:69:60:51:6D:9F:AF:31:9D:5E"}}},"request":{"raw":"GET /images/uTdLWjhUvfSiBaN37kYNLsUu4.png HTTP/1.1\r\nHost: framerusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check-lighter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: CloudFront\r\ncontent-type: image/avif\r\nage: 9938551\r\ntiming-allow-origin: *\r\ndate: Wed, 01 Oct 2025 13:12:16 GMT\r\ncross-origin-resource-policy: cross-origin\r\nx-amzn-trace-id: Root=1-68dd28b0-62e0a1a1342a986e652a28d7;Sampled=1;Lineage=1:f456f256:0\r\nx-amzn-requestid: 21115cf1-c19c-4e70-90dc-a595e0a004f1\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-xss-protection: 0\r\naccess-control-allow-origin: *\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: deny\r\ncontent-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;\r\ncache-control: public, max-age=31536000, stale-while-revalidate=31536000\r\nx-content-type-options: nosniff\r\netag: \"c182ac1f5cdf0192cb7bb079c7356f8a\"\r\nvary: Accept\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 f54d9ad301a95e7dcfde675e1cd5ba88.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: AMS1-C1\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cdn-cache-hit,cdn-pop;desc=\"AMS1-C1\",cdn-hit-layer;desc=\"EDGE\",cdn-rid;desc=\"bW-BabVu5NRRt7hDzAkWYA2WyAM-CBG42CL7FiRqquE8LKtVgxvLug==\",cdn-downstream-fbl;dur=5\r\nx-amz-cf-id: bW-BabVu5NRRt7hDzAkWYA2WyAM-CBG42CL7FiRqquE8LKtVgxvLug==\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":1020,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"c182ac1f5cdf0192cb7bb079c7356f8a","sha1":"88706efb94753d716db16ccae4980c95737dd2a9","sha256":"6c9699573ae3fab005156c397a4cb972448af28ba81140d77df6f9c237eeb212","sha512":"87e4ff082c2bc88d87f9034b9e0338797f7a7471cd850a97c237bbc54812230615be145de379546778091ce29fb2d3531e398780d981cb858401d7913754ece1","ssdeep":"","tlshash":"c911b7a427181cc3e44e023205576b3b3b326970460b33b3eec3f128ccad63ad628c54","first_seen":"2025-11-20T11:15:14.633381Z","last_seen":"2026-03-28T01:16:36.053747Z","times_seen":37,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/geistmono/v4/or3nQ6H-1_WfwkMZI_qYFrcdmg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://check-lighter.xyz/","date":"2026-01-24T13:54:46.927Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:29 GMT","end":"Mon, 23 Mar 2026 19:52:28 GMT"},"fingerprint":{"sha1":"D2:3B:6C:71:A7:BD:CB:B5:56:D1:90:EE:91:17:19:0F:24:02:E5:93","sha256":"DE:C3:87:EA:0D:EF:DF:B6:5C:9C:CE:F8:48:EB:2C:CE:06:FC:22:FD:3A:57:71:FF:23:81:1F:16:8F:67:66:B6"}}},"request":{"raw":"GET /s/geistmono/v4/or3nQ6H-1_WfwkMZI_qYFrcdmg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://check-lighter.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check-lighter.xyz/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 31368\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 20 Jan 2026 05:19:46 GMT\r\nexpires: Wed, 20 Jan 2027 05:19:46 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 17:01:43 GMT\r\ncontent-type: font/woff2\r\nage: 376501\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":31368,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 31368, version 1.0","md5":"bd0693c1a36d67b859220908f04f47bd","sha1":"0d05a98b4df75e88c0d9998d332a7c8b6cd95111","sha256":"e9fb088eeacced307860d82ceedb0ae9ad2ebfa07a7c0a7279c8c961dd9d5fd3","sha512":"2bf2c76a5b99a3b0f73d15120ba60a9c4c6868be77dc53003701d8d29a39d91d5098e7526c2e9640a6426677b57becc881f9fad81d34270257347c02d0bc6330","ssdeep":"768:ZMkC731Q6Oy5ZSvLLz+FjirLXI/bUg2jLIqy8O:7CHOy5CdmNcvy8O","tlshash":"3ce2e161b10bf445c8a44795477efff0af0d0c72296b3051d44ea895beee963b287427","first_seen":"2025-04-29T17:08:33.422864Z","last_seen":"2026-08-11T23:54:49.786989Z","times_seen":187,"resource_available":false,"data":null}},"time_used":469,"timings":{"blocked":214,"dns":1,"connect":16,"send":0,"wait":17,"receive":18,"ssl":199},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"framerusercontent.com/assets/GrgcKwrN6d3Uz8EwcLHZxwEfC4.woff2","fqdn":"framerusercontent.com","domain":"framerusercontent.com","tld":"com"},"ip":{"addr":"65.9.86.70","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://check-lighter.xyz/","date":"2026-01-24T13:54:46.935Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"framerusercontent.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Thu, 16 Oct 2025 00:00:00 GMT","end":"Fri, 13 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"31:EF:AE:14:9A:1C:B7:8C:AB:DF:01:C0:39:9E:AE:49:90:E5:84:94","sha256":"B7:E9:B0:B0:73:ED:29:A4:09:64:FA:77:EF:60:53:32:51:10:08:95:FD:7B:4A:69:60:51:6D:9F:AF:31:9D:5E"}}},"request":{"raw":"GET /assets/GrgcKwrN6d3Uz8EwcLHZxwEfC4.woff2 HTTP/1.1\r\nHost: framerusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://check-lighter.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check-lighter.xyz/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: CloudFront\r\ncontent-type: font/woff2\r\ncontent-length: 27380\r\ndate: Thu, 04 Sep 2025 10:53:00 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD\r\naccess-control-max-age: 3000\r\nlast-modified: Tue, 12 Aug 2025 12:29:40 GMT\r\netag: \"509c9e2f344ef936dcfd0c2415c6ddb7\"\r\naccept-ranges: bytes\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-frame-options: deny\r\nx-xss-protection: 0\r\ncross-origin-resource-policy: cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 3108b3c3c306768051fa0658c0445308.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: AMS1-C1\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-amz-cf-id: 3GKHuCWawPFz_h4SxF1TshegqSxgrTDVDT5szy_b96Cb8wTqGQnoZQ==\r\nage: 12279708\r\ntiming-allow-origin: *\r\nserver-timing: cdn-cache-hit,cdn-pop;desc=\"AMS1-C1\",cdn-rid;desc=\"3GKHuCWawPFz_h4SxF1TshegqSxgrTDVDT5szy_b96Cb8wTqGQnoZQ==\",cdn-hit-layer;desc=\"EDGE\",cdn-downstream-fbl;dur=11\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":27380,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 27380, version 4.0","md5":"e092f17f85b5a6e5a73296c5819acee5","sha1":"1ab81cfcac2b37a777533f04c1c2c7671c047c2e","sha256":"362b168da82d69bc67d2a358fa20c59151cb4ceac8a5506be6baef5e6827fa42","sha512":"37756285b8dc6d24f04f40b3733ce2e3414f1242b0cf4715ad1a1082901d81caf10582dbcd2060ac8886902aa33d4fc2b1bd717215802f933aea929d181cc5c9","ssdeep":"768:uVmFXapd3t+i2J0dlFlL9baVrL0c8yMErCOtRPCM:uGXabqJsl5urL0xErT9CM","tlshash":"e0c2f1e694653af9ed0d707b065af62b539068bc436e807d9cf960b077a3bd1020f496","first_seen":"2025-08-12T17:14:20.779189Z","last_seen":"2026-08-16T00:58:17.311163Z","times_seen":4039,"resource_available":false,"data":null}},"time_used":167,"timings":{"blocked":57,"dns":1,"connect":17,"send":0,"wait":32,"receive":12,"ssl":44},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/geistmono/v4/or3nQ6H-1_WfwkMZI_qYFrcdmg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://check-lighter.xyz/","date":"2026-01-24T13:54:46.990Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:29 GMT","end":"Mon, 23 Mar 2026 19:52:28 GMT"},"fingerprint":{"sha1":"D2:3B:6C:71:A7:BD:CB:B5:56:D1:90:EE:91:17:19:0F:24:02:E5:93","sha256":"DE:C3:87:EA:0D:EF:DF:B6:5C:9C:CE:F8:48:EB:2C:CE:06:FC:22:FD:3A:57:71:FF:23:81:1F:16:8F:67:66:B6"}}},"request":{"raw":"GET /s/geistmono/v4/or3nQ6H-1_WfwkMZI_qYFrcdmg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://check-lighter.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check-lighter.xyz/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 31368\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 20 Jan 2026 05:19:46 GMT\r\nexpires: Wed, 20 Jan 2027 05:19:46 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 17:01:43 GMT\r\ncontent-type: font/woff2\r\nage: 376501\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":31368,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 31368, version 1.0","md5":"bd0693c1a36d67b859220908f04f47bd","sha1":"0d05a98b4df75e88c0d9998d332a7c8b6cd95111","sha256":"e9fb088eeacced307860d82ceedb0ae9ad2ebfa07a7c0a7279c8c961dd9d5fd3","sha512":"2bf2c76a5b99a3b0f73d15120ba60a9c4c6868be77dc53003701d8d29a39d91d5098e7526c2e9640a6426677b57becc881f9fad81d34270257347c02d0bc6330","ssdeep":"768:ZMkC731Q6Oy5ZSvLLz+FjirLXI/bUg2jLIqy8O:7CHOy5CdmNcvy8O","tlshash":"3ce2e161b10bf445c8a44795477efff0af0d0c72296b3051d44ea895beee963b287427","first_seen":"2025-04-29T17:08:33.422864Z","last_seen":"2026-08-11T23:54:49.786989Z","times_seen":187,"resource_available":false,"data":null}},"time_used":524,"timings":{"blocked":245,"dns":3,"connect":43,"send":0,"wait":15,"receive":22,"ssl":188},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"check-lighter.xyz/index_1.html","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"ip":{"addr":"104.21.84.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://check-lighter.xyz/","date":"2026-01-24T13:54:47.140Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"check-lighter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 10:19:19 GMT","end":"Mon, 30 Mar 2026 11:17:46 GMT"},"fingerprint":{"sha1":"4E:9F:22:1B:17:8B:3B:7C:13:D6:47:3B:CE:98:81:39:93:EB:AF:FB","sha256":"06:F1:59:CB:DE:D7:56:37:7F:E2:AB:C7:59:E4:6B:E3:1D:11:3C:19:50:71:2C:CA:D1:91:D1:AA:89:BA:02:4B"}}},"request":{"raw":"GET /index_1.html HTTP/1.1\r\nHost: check-lighter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check-lighter.xyz/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 13:54:47 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Tue, 30 Dec 2025 10:45:27 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nvary: accept-encoding\r\nage: 811\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FaMF%2FlNahLLJ%2FPD6abl%2FQnCT2%2FtEbLtP6YihMZpsihwMf3xIuOKfR%2F31qJmpSUvlLJxLnmrAnW9yWVZzwp6QUChF2sifq3fS%2BG%2BiaCJ%2FFA%3D%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9c3006545e7cb51e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":786,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (349)","md5":"b43f2885d02074208031ef6084a16f22","sha1":"e1155f085fd3876bdcee2d89dc956d35e8088eee","sha256":"a54ec88e0194841f2af42c3f3ca3d7d4ccf9c67b544c437b89410a577d4ca7a9","sha512":"1f0397885af28c9f6c247dbb53609e7fc3083b77f9bd258c5ff11c555fd51e49a1a72c8e6d3e385a705ae569abe0b29a5fc5a286fc39bd11d7e80abe49f0c824","ssdeep":"","tlshash":"3501d063c4f0641e04438576d8c0b18c07848a57f6326c91fd8c864d5f99be9cdab76c","first_seen":"2025-12-28T21:10:08.049856Z","last_seen":"2026-03-10T10:43:21.617742Z","times_seen":13,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"check-lighter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"check-lighter.xyz/lighter-image.avif","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"ip":{"addr":"104.21.84.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://check-lighter.xyz/","date":"2026-01-24T13:54:46.374Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"check-lighter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 10:19:19 GMT","end":"Mon, 30 Mar 2026 11:17:46 GMT"},"fingerprint":{"sha1":"4E:9F:22:1B:17:8B:3B:7C:13:D6:47:3B:CE:98:81:39:93:EB:AF:FB","sha256":"06:F1:59:CB:DE:D7:56:37:7F:E2:AB:C7:59:E4:6B:E3:1D:11:3C:19:50:71:2C:CA:D1:91:D1:AA:89:BA:02:4B"}}},"request":{"raw":"GET /lighter-image.avif HTTP/1.1\r\nHost: check-lighter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check-lighter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 13:54:46 GMT\r\ncontent-type: image/avif\r\ncontent-length: 134569\r\ncast-mode: default\r\nlast-modified: Tue, 30 Dec 2025 10:45:26 GMT\r\netag: \"6953ad46-20da9\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 811\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IF9oder8SfW3XqtMebOOUKeh81T8XRFde2IQ10nbfeuMBRqb9dGKCHOTUv69lSX6pgVH0zQx%2B0xjhk2B%2BF8725KWiu7JRWqM5Mm1h6WIZQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9c30064fde56b51e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":134569,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"b44f2e4ec5f212f70320fc918a7e9220","sha1":"f53885a52861e781bb593c3a5b454aa850a87de7","sha256":"4f600e3a6a0b69d403bb0c60e923154e2eb744a58bd74204d1c81eb5c8e797c0","sha512":"a4a74740bf80f07336a19e5a20df890a05f2fc2a3fd9eca7fd3d509e7687791a9db62126040b1bdfefb901e5d12ff5f58d37212220451d8c968a1be6f2f89fa0","ssdeep":"3072:w7n5uYqCO71tgS287RibulkkstsoKGQkRPc4LZeyxpLE9sG:w7n5uYqCOTd7BkvQidZeyxpLE9t","tlshash":"8dd313cc3a2a7ca1c62c26fa191f9ff5f67ea858b105ffc5161e50abe64d05220de113","first_seen":"2025-11-20T11:15:14.642339Z","last_seen":"2026-03-28T01:16:36.053035Z","times_seen":48,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":8,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"check-lighter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/geistmono/v4/or3nQ6H-1_WfwkMZI_qYFrcdmg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://check-lighter.xyz/","date":"2026-01-24T13:54:46.954Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Dec 2025 19:52:29 GMT","end":"Mon, 23 Mar 2026 19:52:28 GMT"},"fingerprint":{"sha1":"D2:3B:6C:71:A7:BD:CB:B5:56:D1:90:EE:91:17:19:0F:24:02:E5:93","sha256":"DE:C3:87:EA:0D:EF:DF:B6:5C:9C:CE:F8:48:EB:2C:CE:06:FC:22:FD:3A:57:71:FF:23:81:1F:16:8F:67:66:B6"}}},"request":{"raw":"GET /s/geistmono/v4/or3nQ6H-1_WfwkMZI_qYFrcdmg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://check-lighter.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check-lighter.xyz/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 31368\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 20 Jan 2026 05:19:46 GMT\r\nexpires: Wed, 20 Jan 2027 05:19:46 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 17:01:43 GMT\r\ncontent-type: font/woff2\r\nage: 376501\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":31368,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 31368, version 1.0","md5":"bd0693c1a36d67b859220908f04f47bd","sha1":"0d05a98b4df75e88c0d9998d332a7c8b6cd95111","sha256":"e9fb088eeacced307860d82ceedb0ae9ad2ebfa07a7c0a7279c8c961dd9d5fd3","sha512":"2bf2c76a5b99a3b0f73d15120ba60a9c4c6868be77dc53003701d8d29a39d91d5098e7526c2e9640a6426677b57becc881f9fad81d34270257347c02d0bc6330","ssdeep":"768:ZMkC731Q6Oy5ZSvLLz+FjirLXI/bUg2jLIqy8O:7CHOy5CdmNcvy8O","tlshash":"3ce2e161b10bf445c8a44795477efff0af0d0c72296b3051d44ea895beee963b287427","first_seen":"2025-04-29T17:08:33.422864Z","last_seen":"2026-08-11T23:54:49.786989Z","times_seen":187,"resource_available":false,"data":null}},"time_used":421,"timings":{"blocked":190,"dns":1,"connect":17,"send":0,"wait":33,"receive":8,"ssl":169},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"check-lighter.xyz/Zo886XiD1XYr0RbkjdJiQYOPW4.png","fqdn":"check-lighter.xyz","domain":"check-lighter.xyz","tld":"xyz"},"ip":{"addr":"104.21.84.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://check-lighter.xyz/","date":"2026-01-24T13:54:47.491Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"check-lighter.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 30 Dec 2025 10:19:19 GMT","end":"Mon, 30 Mar 2026 11:17:46 GMT"},"fingerprint":{"sha1":"4E:9F:22:1B:17:8B:3B:7C:13:D6:47:3B:CE:98:81:39:93:EB:AF:FB","sha256":"06:F1:59:CB:DE:D7:56:37:7F:E2:AB:C7:59:E4:6B:E3:1D:11:3C:19:50:71:2C:CA:D1:91:D1:AA:89:BA:02:4B"}}},"request":{"raw":"GET /Zo886XiD1XYr0RbkjdJiQYOPW4.png HTTP/1.1\r\nHost: check-lighter.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://check-lighter.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 24 Jan 2026 13:54:47 GMT\r\ncontent-type: image/png\r\ncontent-length: 50521\r\ncast-mode: default\r\nlast-modified: Tue, 30 Dec 2025 10:45:26 GMT\r\netag: \"6953ad46-c559\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 811\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P5PGdEkXT2lOocYZ0gvWZ16d49kaUcpYB%2FhTpKAEdKGGGgfdtkQsQp2dSeOhdG3PM%2F7i1Gw23KfCYAvBhlX1iZcOP1FxmUGYKk%2Bwc3qfMg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9c300656be92b51e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":50521,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 800 x 800, 8-bit colormap, non-interlaced","md5":"8b958c031409bd4d605e7e1ac9aa3894","sha1":"655a270d23ec8c8cb70a88a4c31cbc3086df018d","sha256":"8de025152b953f3d5c90fd25177cc423a60a0b960aa6c4379772cb49afdf5a06","sha512":"9a70aec12f8b187665c3128885509f8b1e016a38eb7bb01a33a105b5d40223f3cfe41636f86e7a38eb0263e8fdb95ad6b9fa8cb896a0344679f75a4a8994f3c0","ssdeep":"1536:+AivQm+T+QV8oJgI2/MqX45byWIBnKq7dj:+AiYBV8GgrY58KGdj","tlshash":"7f330266512f79f4d2ce264de1d47af291f92a322015049deccdfea025f04bd0ea49b3","first_seen":"2025-11-27T21:37:46.561355Z","last_seen":"2026-03-10T10:43:21.624432Z","times_seen":24,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-24","alert":"Sinkholed","trigger":"check-lighter.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}