{"report_id":"56792126-fffa-45de-9631-5374fbcd4f42","version":6,"status":"done","tags":[],"date":"2025-12-30T17:21:17Z","url":{"schema":"http","addr":"bullrun.ms","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"bullrun.ms/","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"title":"Biggest CRYPTO giveaway of $100000000","dom":{"size":1479,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (443)","md5":"c4ee24cb087e1770cfb0b83639d4c090","sha1":"245dc1d3763dbb83d62a49e0b5f915d1f966bfca","sha256":"e410ff62e7b39a4c9a7ead269d1725b64ab3292d9bbc940e3f93bfc27978b78c","sha512":"683fbc37ae924e62fa148f808420da44d0e0a100c87ecb38f8e187fde5ed4af2e6fc49f47555c7f08204a1f4aef39ade2531f5eaab41662b313b3448b19cec3f","ssdeep":"","tlshash":"1231c0a3e38f744e7102c12854f1f2b81e3fa158b7055f29bc21b7737b8daca54a2955","dom_hash":"domhash003fb3f0de8126b803198d4c3d676989","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"bullrun.ms","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-03T17:21:17Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"bullrun.ms","ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-12-06","domain_rank":0,"first_seen":"2025-12-30T17:21:19.555592Z","last_seen":"2025-12-30T17:21:19.555592Z","alert_count":33,"request_count":33,"received_data":2483309,"sent_data":29716,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"embed.tawk.to","ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":52083,"first_seen":"2014-03-19T21:03:49Z","last_seen":"2025-12-29T02:24:26.909834Z","alert_count":0,"request_count":27,"received_data":1365808,"sent_data":12301,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"vsa29.tawk.to","ip":{"addr":"104.20.42.169","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":3091943,"first_seen":"2020-03-11T12:20:19Z","last_seen":"2025-12-25T07:42:38.236255Z","alert_count":0,"request_count":1,"received_data":417,"sent_data":1074,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"va.tawk.to","ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":51316,"first_seen":"2017-01-30T04:20:46Z","last_seen":"2025-12-29T01:33:02.619334Z","alert_count":0,"request_count":5,"received_data":7419,"sent_data":2550,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2025-12-28T22:26:34.892336Z","alert_count":0,"request_count":1,"received_data":303634,"sent_data":437,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-2d0d2b7c.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ecc9e5cf090bf5602a01763e2895acad","sha1":"1d07eaeecb0a31f0d95363694e803282518f81a3","sha256":"1cb6c04d780fb838f64fe8bad72bbc16ff24e2466f9ba3123471321f8342cc0a","sha512":"9ace38dcdfd09222ce1f2536d8e4acc781b0055d6ae35486922b86baa540befc98bd9a5bc67bb00b0ef09b9da16ec97b1fe3b2b676b1403cde8eb2c13981870b","ssdeep":"192:0CFny7CpmxwbZlR1cwr40v0zSrj5D6/L6LvGokD36b4hwseQ:08mChZlRNr40v0GF/LvV4hwsR","tlshash":"073295b7e0a1107ea316871c506fa610f61f6c8ab2161da6b67ab46f900ddcfc065f7c","size":10938,"data":"","first_seen":"2025-11-28T06:07:28.918411Z","last_seen":"2026-06-15T21:26:04.407385Z","times_seen":26443,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-2d0c8092.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"573176a5696bc8177ef9cd22d0314c04","sha1":"d2df89ca54fab39b53d35912867df378a296d4f7","sha256":"63ec3e8ad1852f45903471a3c14e92bc8c52d642add091aef6566c845d79ec17","sha512":"0dd9982a020f84f23ffe6a1882d276b587e39d0b9378f0b7f2208d441a0827fac1d819fb315747cd4c7a938fdd066045375c4a57e854f84a265c069635958586","ssdeep":"96:zNC9Hqt7pEma7hY/rcK3JBPDRIv6hJQ7i16p3n4vkjvxQcsD:zKHhNYxLRIvgx43nVY","tlshash":"08b1859af247b456c156225150ef3b1df33a281ca61ccdc4a66565f218784cba077b39","size":5261,"data":"","first_seen":"2025-12-29T13:02:03.575644Z","last_seen":"2026-01-16T01:10:38.060616Z","times_seen":1980,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-2d0da3af.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3b4359ddef38a38d73a020b75ae0eada","sha1":"8e430241157a3618237b94786f71d90411366b1e","sha256":"98bdb92efa9cb16b3faa6adaa13629dd3b1f800222e07fcf8087c3d3a46c3bde","sha512":"1f56aeb2f726daed834534a49f0bdacf24bc6e0da191562c4bd3fb7c575ae30413c869800cb07dda184522bf23faec3c375270f685d916c4aa4d85160dc189ad","ssdeep":"384:UJw/U5YK8Hx9KJNThWazJbUZDkM0kWEYPk6F+UtKM5eH:6+9KJNThWazJbUZDkM0kWEYPk6F+92eH","tlshash":"0352c6a7b2a4782d42379712308f3205f33b7d45b215da19f36edcea4aa84c16056f3e","size":14213,"data":"","first_seen":"2025-12-29T13:02:03.587693Z","last_seen":"2026-01-16T01:10:38.073094Z","times_seen":1791,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-6289ff8e.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"06b3d1d4768c7fa3c9280fe71898f58b","sha1":"6ccb7d3ddfad4a07849870168ccfb688d9e68a14","sha256":"35afdec53f99f6cb402ad2b780762bf19ef9ceaaf4c79e9d5b854636abbdb828","sha512":"c9085d5849bb21a33b2823f8ed2821dfbc7634efbb03a8ce0b2a0b6c0e7111cab497b45b25430cf1abac44e2364be2925c42f9810acfc9a3bfff9f759224c9e1","ssdeep":"1536:BigMTWFu196wufn32jGDdgaOFUWbaGlDluK1MFYjdZPkx3u4V5pfYMrlSf:4nmuTilGhmnx3u4V5pPrlSf","tlshash":"77a3096ef091b47d8993d26120af3212f3363d55a919d0a8f234cdf859d89c9a127f3e","size":106023,"data":"","first_seen":"2025-12-29T13:02:03.567496Z","last_seen":"2026-01-16T01:10:38.053132Z","times_seen":1959,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"5fe7599f4a23b4b7f978c6fc8f68800e","sha1":"cb26ce2c679163220f43bbe1a16828e9c1c16e6a","sha256":"68f040391e582cd498f66bf923fc6cf8e71caaf784a53ca3d1e3d11891fc90f0","sha512":"8ddf9f726b485f2dc02a1158a9deac9893373e368cbcc591562653991952211ab53dbd65a373d937cb3b2db1d2fea5e585c5fe1434a81c1e29d2491a72560f0e","ssdeep":"","tlshash":"f81104757e161634c5c54147317de7a93e3250717a02a044c26ccc255d18f8714dfcbe","size":902,"data":"","first_seen":"2025-12-30T17:21:27.906905Z","last_seen":"2025-12-30T17:21:27.906905Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"078c2cc6c147850365fc51eec732a3ea","sha1":"f96384b3a0dcc1216f43184f94e15a547eb7b3f5","sha256":"738d574bfeab377bc2ec68d87d0fab26a0c48fc857cf260a5456e7dc9623c455","sha512":"1381705ae9a6e61d0bad8ffc3192d2c11da68496a89eedf17e9c04d907c2ebbcab5bcca54340969c9b0fe6152832e4fb389d54056eb621e00a94508113e41df4","ssdeep":"","tlshash":"b5d023997c758e345199024710f5d3952b6020a07711b200d1dccc7b5e11fd348b999c","size":217,"data":"","first_seen":"2025-12-30T17:21:27.908526Z","last_seen":"2025-12-30T17:21:27.908526Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"88a769d2fe35899fd45a332a0a032cc0","sha1":"514c6c1d8475d17e412849a4c90159517d0fa10a","sha256":"ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142","sha512":"756cc5cd029fc4adc9100d0da2f2b0efb3df0f2bf894fba2824019832fea594edd40a238a5ffacc205572cc0155f5632d70f54e37edc0772460f44c69cb76ab8","ssdeep":"192:3dArCS2Z+j/yQ9TCQxUhW2DPY808LE676SbHDc/7uN0VZG05w:NHSG+j/y2xa3bn7Q+0a0O","tlshash":"7442b79c7e95ba30079b91b1a17ff30f6276605a640bc0a0b05ddcd1a878d8d192bf75","size":12332,"data":"","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-07-22T23:47:11.845311Z","times_seen":121812,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-main.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"da5bb1dc647470204df0e49f5afac2de","sha1":"f5cbf596ca5e4fe208e4c55af6e45b71f9febbe8","sha256":"705186becc9e0a306a6b4867ae2768aa9dd3b8c12393d9f9c52029e9a6fcf31c","sha512":"d9c0eda8c93df421f8147960ff4b00f8eacd8791b8386b020f04d0478c6b7a4328767a82b52b8cfbb7c3a44cb55cec488c2d1008670bee709d67d8bdbd887c39","ssdeep":"","tlshash":"d4b09b6c1057f86955e8064ed3b7f65d1d961050811104301658a1753321143c61c55b","size":121,"data":"","first_seen":"2023-03-07T01:02:45Z","last_seen":"2026-07-23T00:48:08.527916Z","times_seen":91179,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-common.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"890a2ff1f0bf72e7b248d102ff79740e","sha1":"201364499dd1839b7b4c491d89a865cc237063e3","sha256":"ef4ad578694c8fb01728aa2043d57113ce46d562939dad05ae75c172f4c1fb35","sha512":"15211872fb2591548ace05e32ff371957157a3a6f21e980e4f66161755aba29d1f23e53f9794ddc9c098d3e5c19895127f486114cff559ce641ee58298569721","ssdeep":"3072:I4MYggYqWzhT9dyWFW1Wn+fM4fOQcErQYIMPdLMz9o115:kyWFW1W+fM4f8kBLMz9215","tlshash":"c234c69df186b47606a37130501f320af23a685ab45ac494f636d8e1bd789cea133f7d","size":240941,"data":"","first_seen":"2025-12-29T13:02:03.600994Z","last_seen":"2026-06-13T18:18:43.537665Z","times_seen":3819,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-vendors.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"44b9fc99078bcfe4490fb15034bc1e15","sha1":"ce24732180436c239c9f7b652793636862abc0cc","sha256":"b3b902e256ff96b3cfb1ce9f97156c7c2ed18a316f2db4328df5ecbffdebe765","sha512":"6dd243ad3d514c4c174dfccc05d61de84ef7225c808b06be721ac89087cff49b3f643654a6739273bf437f20208ff2b0031552ac2f1a9c81b549cb6fad720ed8","ssdeep":"3072:NTX1gABPVhOj6y1ekyYadM/9LJQMoZm+odXsJ5Ar6VKkOPmx/:FGABPVhO5wdKJCMo4sJ5Ar6kOx/","tlshash":"ea644bc8f183b0b606e6a1a5009f5207737a151968ed8498f574dee968e8e5c633bf3c","size":324110,"data":"","first_seen":"2025-12-29T13:02:03.642071Z","last_seen":"2026-06-13T18:18:43.524898Z","times_seen":16307,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-2d224aff.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"872f914720cfc7b657f405012ea10c8a","sha1":"1bf2386624138057451b1bdd97311e9ce1e7d0ae","sha256":"1a9ec11e322de9a2af57eeffaa69f67b49556972fade1dff81f46664427aeb63","sha512":"5cc6f30901cbb79151b79139f3a8b4e83c7a1b9e170447b4c49d177b1edc77706785552ba2b071c5bd69d95a224a4482f8b6ec7765aa25423ff42a798ec56c99","ssdeep":"384:jqiSR0nIa0kIrCQl2kL3kCwGN//h6LiJq:SzP2DaSLi8","tlshash":"61822ba6f149311bc925c750605f2228b33b19a9fa1ece7df2745cf245a8cc2906af3d","size":18392,"data":"","first_seen":"2025-12-29T13:02:03.603079Z","last_seen":"2026-01-16T01:10:38.088072Z","times_seen":1977,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/assets/c3d90a4372d43ecd.js","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3169c3427cd464a71be90bf15fabb221","sha1":"fb169f8414d35e63e40bea714bdb4b224fb0a170","sha256":"bd54ac978dfba32528ab7be4d596cce9cabbb7ee69051bc0b1f35f1d5a336b7d","sha512":"d36b8b70cbb44fb5fad25e15982cd4b6aaf13b4f9783de988a15cf5efd66a3e7dd2eff7553b7536d06950baa61860f1ec68fdbe0f2ee67006785ac5a705f228d","ssdeep":"3072:yWK5Omb5wO2d3+MhWoDLs/RwaFfq3Sap0xQ/UbvxJ3jEHYxJz72Y/aoA2AzlIga:yWYn2T/M/R9FfqiapX/SvPQAz7tZA2Oa","tlshash":"525438e832d2b06243a75af5507b1006f63a2955380dc4a8f16cdcdb3d7694a92bbf7c","size":300251,"data":"","first_seen":"2025-12-30T17:21:27.86241Z","last_seen":"2025-12-31T16:02:29.74884Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-app.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e736e189edb5d0d9d5b8e7f23dd9114a","sha1":"bcabee193f13756fa9154fc492fe420c47140343","sha256":"13cf82e6f9d48221cd55f8b3c3d206f7bdb83f291034b478e484ccfef7d500dd","sha512":"ea972884c185633ea238bdacea6ac9da0e0e92f88588cd85c214514c3597bc7d811c4dc4cd35b671dd2db97179bedceb38bd5d200abb9653fbcaeac2ca6ec7b5","ssdeep":"","tlshash":"a0c080ac1496fc9c1674154a8377f54a5cd510108055141015d851a11311546560c54d","size":151,"data":"","first_seen":"2023-03-07T01:02:46Z","last_seen":"2026-07-23T00:48:08.490009Z","times_seen":91206,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-vendor.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3b341e35b39f6195793ecaf5db7c1d63","sha1":"3ef56ed9ac8bfbf5347dc4592653703f59763083","sha256":"548669d6434f5204dca25b9a6f8a02f63301b8c1b58a717b91fec8b6c2918305","sha512":"6b222121b74ffeabd4de7b69f354ad25283d0989376e8e3f6d97f829e28175291eab0a535ca77c22d3f65595250ad9ad3909525c2eb74bf9783f4955c3d7cde2","ssdeep":"768:kURUFvX9zXAfE4dm9+fuDosXRfMySUHM1ONdYO31hY6d/o6cyO4fefHvSAW64F:kURUZXGfzd1uU+8ODY6JORfHBWJF","tlshash":"b483e6dcb295b57117ab20b5417f050bf33a7815a80ac0a4f266f4da7c7848ea06bf7d","size":82913,"data":"","first_seen":"2024-03-08T05:46:53Z","last_seen":"2026-07-23T00:52:34.079447Z","times_seen":64687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-4fe9d5dd.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8249fafc9a9fbe0f75d4bef0aae2305a","sha1":"fab6dda0967dfbaf8ba0cfe5cfade8e150d1735d","sha256":"69b650b4d6479fd29987836a9b74147aade85cc9c50024bcacd5dfb2cb793e8d","sha512":"d0bc9a750061e5b4b761db081656b0e1e655126a413aaa22e87ce14cdfaeac34d532acd08eb0d61274707212871f6d84369b8b2a1a6d3e6c3bfd3d4167afa865","ssdeep":"","tlshash":"f9110248f056b8fcdc8af64288df143034627d4a898cf9e6f5f0aad405555ab312bb5f","size":1000,"data":"","first_seen":"2025-04-29T08:39:38.372752Z","last_seen":"2026-07-23T01:07:21.821344Z","times_seen":48240,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-3ea2c7ce.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"52698c6dc96b5f2bd13e8f921334e398","sha1":"eb0adbc44ebc73775c5cca0a3851e8a6510d360c","sha256":"37527b07ac54a4567d7e23bde1edfde8ed74c4f30402c96fb56f4c0020c6af42","sha512":"032e41ececcfc651f34c235d15953baacb81e7cfaf492dd919c7fca2a7c49d507ae4a60710064c5419df70eb581254058dffbf1d0d4c53ef47d87bce4e036524","ssdeep":"96:60WlCWYW5rugkENQdx0hZUASzpqrcHZ73abT3Qlgjm6i5cCEsK7oGuyGwDf/2/5N:XBTW5qgNQdAR7c573abF8cCEsK72/5N","tlshash":"b5b11982b251b4668ab5380045cf6f07b07baf4f5d09cd50d783e4a3b230c5a9667e8c","size":5504,"data":"","first_seen":"2025-11-13T12:40:48.559139Z","last_seen":"2026-07-23T01:07:21.818651Z","times_seen":40631,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-2d0aef27.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"fd334ca02da729de662d9c4f3a3c1b08","sha1":"c4d597fc0b45c88349c9386a1dcd9b743d546d7f","sha256":"ca0743a74dc010d603d8b170fbe2a9df6a0540db8ad2338bac2c26d52a885052","sha512":"df2f6995fef3a464e3105ef05560f3cbab5a2eb6928f878e5c3926fc7682fd5f0e662e5ac1d01628aa7d5c327157c1e9eff0abb9d948f6caab1eb3591a047c2c","ssdeep":"192:kHNM+/RIU9HkC40V2tl+f9lVo7QYcb26o5A8f6uYZvUZaUZSPgM:G/b9HkCreHA87YZHh","tlshash":"fa32d7c6f9c7b9624227524841efa218f73f2a947706dc18f06899f30a948c75077bbe","size":10989,"data":"","first_seen":"2025-12-29T13:02:03.629914Z","last_seen":"2026-01-16T01:10:38.090265Z","times_seen":1458,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-7941cc06.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"09a6b2a4fc1400ec37c1115e6aa1670f","sha1":"d703fbc76276de75b56fad5c189fb663146d116b","sha256":"59147272a66366aa00b1f3771a23f360ee90c3bcac88ad31f59d29562b2d3c28","sha512":"2af2fecb20cad761430bd295a3e8846ad7404f20c9610dc8e20010e4d941b9067a192e700a964b92fccd2289ae4a10eb0e2ae81db8323b49bc3c0543dfe0e457","ssdeep":"768:Vlxfu8+HYUmI+rTRWf2z+y+Um/+VRJWf/W+Hc1lt7Gj67IW8/JGvgLCBxf6stK43:xfurowf20UJWfO+Et7GZrC90k","tlshash":"a533c8c9b2d6f4258763632130af3006f27a4964a81dd155f334d9f6b9ece48a227f2d","size":53530,"data":"","first_seen":"2025-11-13T12:40:48.539817Z","last_seen":"2026-06-15T21:26:04.427415Z","times_seen":34009,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/emojione/2.2.7/lib/js/emojione.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7bb7aac0cac89a90304af1c72eb4f50d","sha1":"729f6f8ca5787d89743b0ed7eb27fd76406bf985","sha256":"f5c06455e539dcd889f7f05d709b5adc76c444099fe57f431365af2fc57e803b","sha512":"ed26bf873a3c5b2e48d8b3c955240a46d8f7d7f3c635ab138179b999dbadc77802285879cb1a833f703059762c346066090a9a740bfe881f56d6d95f2dca7f30","ssdeep":"1536:Q/drlyiQh7fh7RqgwkMTyDUV6HeAIDgI9IKQ/d2ffWifiIzQFBSob5/ove:Q/drlyogMVc6FIKV+ZLBSob5l","tlshash":"59546c7a87606deeea94d02d86db374af58c3c0453ed1266b66482cb27f543a33487dc","size":302554,"data":"","first_seen":"2023-04-05T07:49:38Z","last_seen":"2026-07-23T01:07:21.826383Z","times_seen":50602,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e460b22febff9667dd5c3143d4414775","sha1":"ed3cc1d150f6597394f105e2c116589d05991f50","sha256":"34d9b3fb3dd0d3ddb80c8b7cb7c938dc29f31a81ab66fce7630fc749e3bee288","sha512":"75f080fae0eea2e2dce98d48f5d735c007e329e4d7ead19218432d9757978249165bd9c9eef448112c99d174772a2e7f0f4619ca8f62195de280354bc102e236","ssdeep":"192:oE2nFfMtOFbVDFbqnxadqSddd1uh1M9ITEcthnrtTxTgeV:J2nF0tOFbVDFbq2vb1IG9ITEShJTxs6","tlshash":"b522facd3e8879152450e8a174d7a4cfa9d4ce7fc4442817d20849ec772da59faacdec","size":10390,"data":"","first_seen":"2025-12-30T16:49:11.878621Z","last_seen":"2025-12-30T17:21:27.897619Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7236ce1e6efd1a6e394265de42802e1d","sha1":"50dc303de6a4c823c28bf5d821b5913edd722e4a","sha256":"e6a238064614a232a21194b888f5445ed4c1e338c2f2f984ace2094416b1e77d","sha512":"00be2d656e71019e4d94592222da68686ba7305dcb104011da8e7c0decee3e647f76a646dc9bcf402b7489665ddbb0b872d98bb09aa2af53082002870d6c4830","ssdeep":"","tlshash":"e1f02038f850a4d5ebc21070057ac62f90320b82f803cc92d002d2214809cad77a6e77","size":538,"data":"","first_seen":"2025-12-30T17:21:27.911078Z","last_seen":"2025-12-30T17:21:27.911078Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ceff6fd36202006eaf893e16370755dd","sha1":"fe97f053a36d8858862a25ed2f44de1e40b7feef","sha256":"600fe72d60e67246e8c18ed1839276c7848429afc6437a2e9741bd89184356fe","sha512":"ecf71a86a10ce5bfb04c16f6c09ab394fd1fb5a20646c959486efe26c6717d8a417c3e9ef35ec970a2a535e110d59be34638e353e14b9bf8f570a430c87accea","ssdeep":"","tlshash":"97e07d5d3a807d755743939b15f3ee2c34327024a45598105eef8c49290ce5ec514e5b","size":324,"data":"","first_seen":"2025-12-24T00:13:40.759577Z","last_seen":"2026-01-19T19:36:20.517566Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-runtime.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"91fa452cb811ebfd42913ed7aea74006","sha1":"060bc71fe2e4a1f9c98df43b6aba2b2687e12d90","sha256":"624283bdfab2d0b2de4ed2d5e1c443fc4ee513b426345414e625a8d69a058674","sha512":"c8a8fe4bf2b22533178ec9c9be10d7ea9983058b49b5c540bc481621df9e1dafd257e753546e4ce3ac231caae0f86e2e05fc4a3088b78e369607031b07d289f0","ssdeep":"","tlshash":"5441b5d936e4f9ba834328e1043fa016b6353836487be8c0531dd8f5bc38c45811afb2","size":2306,"data":"","first_seen":"2025-12-29T13:02:03.646562Z","last_seen":"2026-06-13T18:18:43.504645Z","times_seen":3819,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"078c2cc6c147850365fc51eec732a3ea","sha1":"f96384b3a0dcc1216f43184f94e15a547eb7b3f5","sha256":"738d574bfeab377bc2ec68d87d0fab26a0c48fc857cf260a5456e7dc9623c455","sha512":"1381705ae9a6e61d0bad8ffc3192d2c11da68496a89eedf17e9c04d907c2ebbcab5bcca54340969c9b0fe6152832e4fb389d54056eb621e00a94508113e41df4","ssdeep":"","tlshash":"b5d023997c758e345199024710f5d3952b6020a07711b200d1dccc7b5e11fd348b999c","size":217,"data":"","first_seen":"2025-12-30T17:21:27.908526Z","last_seen":"2025-12-30T17:21:27.908526Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/aes.js","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"535ff81ab45764c67a7336a70ee7c7a6","sha1":"c1cdb3fc5b8e033fbc2be2638b6189e9f3a4f669","sha256":"991fa3ac0febff65dd238aa07315e6ccb792fb207828b371de8cb353bd4dd121","sha512":"6d26238586710be6349ae23453c110b7d816cd4c0152f24e7c83de117e52d6af3a1aa66d07e9d9c107889a67d13ca84cfeed8abb2ed3403f4d56621846a4fca2","ssdeep":"768:24ecwcqZhf5pl9hKw/PAMZcaEpcj4JAT4tmMF21:Mln","tlshash":"e6b28bae35b0b47e4e8b7f31394a05e2ac67c521ca8a104df148bbd8e1dc5525978bf3","size":25638,"data":"","first_seen":"2023-03-07T12:27:07Z","last_seen":"2026-07-14T21:15:46.210869Z","times_seen":188,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"88a769d2fe35899fd45a332a0a032cc0","sha1":"514c6c1d8475d17e412849a4c90159517d0fa10a","sha256":"ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142","sha512":"756cc5cd029fc4adc9100d0da2f2b0efb3df0f2bf894fba2824019832fea594edd40a238a5ffacc205572cc0155f5632d70f54e37edc0772460f44c69cb76ab8","ssdeep":"192:3dArCS2Z+j/yQ9TCQxUhW2DPY808LE676SbHDc/7uN0VZG05w:NHSG+j/y2xa3bn7Q+0a0O","tlshash":"7442b79c7e95ba30079b91b1a17ff30f6276605a640bc0a0b05ddcd1a878d8d192bf75","size":12332,"data":"","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-07-22T23:47:11.845311Z","times_seen":121812,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/692d9379828830197a9d700e/1jbd0g5dr","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8c7bb3d92d8d1016b79019d95ab35d84","sha1":"65f70720e3ce2209890adef03c48dfaaa6f89137","sha256":"553fa8dbc0e04b510a9902b580af7447f24167b94d53c547dba2e6999a088822","sha512":"f79d701bac9eb4c2a382a6ddb5a0d5ea9dc4ceb8e92c0291ac5ba35c3b92c3d301a469f61c7050c72c04dfa609d4c6890443e034d119cf619fca1c2f1a140ab4","ssdeep":"","tlshash":"5441eed66f8f1862936410dc0cfefe0f747720fa49986c9287080c517a666ad2f8ed68","size":2123,"data":"","first_seen":"2025-12-30T17:21:27.870011Z","last_seen":"2025-12-30T17:21:27.870011Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"bullrun.ms/","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-30T17:20:55.583Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 403 Forbidden\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:55 GMT\r\ncontent-type: text/html\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7sc4daH6K690Jx%2FHyfSoGIW9nFAn6YDQT83mv9s6%2B695pOsmiu2JncyUsR0hIeK14266Jlz1wSZMPZPFShg9CN6pckLvmXTlHsU%3D\"}]}\r\npriority: u=1,i=?0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6335eb69034c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1843,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (1843), with no line terminators","md5":"23322ca8515e8db7493fea9a81fb847e","sha1":"7b80d6bdf329492bfd1f3349fb404f27489ee27a","sha256":"4d8ef8d3784c26ad9aa5f95af7ee1ec14a6e213149ecb01777d70d1de17a5822","sha512":"1a8dd997a42fa00d5809c7502857b3cece5142298e6164a264ee941b0c2049e6e6620553d2901200c9e5527d3eb9d7e49734b338ca98f2f4909d9f98f8d5e3e7","ssdeep":"","tlshash":"c9317338bd12ea34ebc1009512bee76d38755161be02c484d0dcc82a5918feb1c9fcbe","first_seen":"2025-12-30T17:21:27.845077Z","last_seen":"2025-12-30T17:21:27.845077Z","times_seen":1,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":85,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/storage/templates/c8815cbee4542d06/ee9063e5c5b12585.png","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:57.883Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /storage/templates/c8815cbee4542d06/ee9063e5c5b12585.png HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 976\r\npriority: u=6,i=?0\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:58 GMT\r\nx-cache: MISS\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zetnTkKu22lKI4r85rky6cxv4LSFZN77qvy9r8OtLXH7b7amZAb208KRPCI5fU28uT%2FfbjXmjh7Y7XFy6pd0tjGZfYKLtI39znI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6335f9cba34c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":976,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"34119f16cd8898568100b61317a5b1ff","sha1":"54d1b7aa15905bb482e23a941c778929d203b683","sha256":"5b9018643988bb92b7ed95d8ffad67f1fa8e7a93465d52f16eecd8628812125b","sha512":"2a90b73fef78febac7824093860f15aa29ece4d2a69672a7a77630905da61177ef26c1a3561a6e4576da30dbe86cd1b10acf22f68bff07d34f03a6e86250d920","ssdeep":"","tlshash":"e7110cce335c5155cef8359b489c1a5015170a3b4609374610c96c3a2395625b0d576c","first_seen":"2025-12-30T17:21:27.847156Z","last_seen":"2026-06-06T18:37:28.750601Z","times_seen":7,"resource_available":false,"data":null}},"time_used":143,"timings":{"blocked":4,"dns":0,"connect":0,"send":0,"wait":138,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/css/branding-widget.css","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.877Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/css/branding-widget.css HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 29 Dec 2025 09:58:35 GMT\r\netag: W/\"fe979c92a5ad992510e5629b84a23526\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 112896\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335fffd38b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19329,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (19281)","md5":"fe979c92a5ad992510e5629b84a23526","sha1":"4fee6cd9de53fa82feef4042aa83202f4cd194a5","sha256":"de84306c96c98314e1a796f26df99a70f20590c535a678215d89560007b4dacf","sha512":"633913cef35247da29e85dde7c279353761606e6c508690d4d5924aa89f563354e44c51b053f785800fd3b599feb8fd2d69a2fe55162b4ccab95c84f8ed8739d","ssdeep":"192:XeI2u2acuBLZNgxYe4fbfYLFFDw25lYVRgtUramxi71NZcFRKV7:uTTacuVZNgxYe4fbgL3w23U3xi7vD1","tlshash":"af92dca3b9e310dcd557c632c0d1f67ca82f9a24c357c6e3a9037bb986827d7264198c","first_seen":"2025-05-21T12:18:34.239407Z","last_seen":"2026-07-23T01:07:21.810598Z","times_seen":37804,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/assets/f3796a3fec02d9c2.woff2","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.706Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /assets/f3796a3fec02d9c2.woff2 HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/assets/e2e81665a6db4c3c.css\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 11232\r\npriority: u=4,i=?0\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: MISS\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cwfQgLEyhESKRxkim%2B6ItORi6YD9TDk1cLwNaqHKkfVKy0imCx1aojfgScChi%2FIoraGijEf44Se9CYwV6WixD4BaNrxO3PtyEag%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6336052da14c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11232,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11232, version 1.0","md5":"f4429b00adf61350183e1037f446fd40","sha1":"a23ad1c7b309f8da507b96efad46313f72d3a351","sha256":"ad234f0985f2142bb1fa3a281ddf2511d320f84f73422df2b2384f115b4b9131","sha512":"4878a81633320634eab8d6493c130eec573834433693096b2acecaf0bcc9232c2a945a06a61b2e4522e1a5f789b84221098dfca7d6db071efe9586bd77c07bf3","ssdeep":"192:lIIvN2i4YfGz24CRxgELe5Wx6gN9bXf30Am9Ht1NOqQOn6ivI:lIIvN2i4rz2bjESvfPTmtXOdqvI","tlshash":"0532b0e8abda6657464636f7b49a0c7cc1d41b442f1f4a0a1886c733905f72a8248277","first_seen":"2023-04-09T18:33:33Z","last_seen":"2026-07-20T22:48:12.575349Z","times_seen":836,"resource_available":false,"data":null}},"time_used":178,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/languages/en.json","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.164Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/languages/en.json HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://bullrun.ms/\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: application/json\r\nserver: cloudflare\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"4662c7c182dfe30065936bfa05f8c773\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335fb7bff56b4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11595,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"4662c7c182dfe30065936bfa05f8c773","sha1":"d1f155c335c31be5947ef8ebf82be1eee2782fc2","sha256":"2d2d85dfc80ec4f42d12bea574d59879d269b5c06557cf888367fbfa9036fe47","sha512":"abd2530371ef02602814b0bed360225c0530615c5db002d61511bca5e8cda0d8da2bd288631ee02da5fbf952b31bd4380284dcd56838277b52654f7d13dc6229","ssdeep":"192:wmr65/bLHzPrquLUVid+BCzfF+npqpe9svKGC6KEt1aZwf1E:fCbLHzxUVid+BEfF+np59L3Zwfi","tlshash":"ed323169ce504ea702d29646399f35437624829b1f54342eb78c91ac0f8ec6fa1f77ce","first_seen":"2025-06-18T04:11:24.033166Z","last_seen":"2026-06-15T21:26:04.41843Z","times_seen":49917,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/css/max-widget.css","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.966Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/css/max-widget.css HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 29 Dec 2025 09:58:35 GMT\r\netag: W/\"a35b82146e32cd2ec43b3eb8a4926580\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 112910\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6336008d46b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":100291,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"a35b82146e32cd2ec43b3eb8a4926580","sha1":"3a63c7d642cd8906a52f6c3079ef6a4bb02e13d8","sha256":"4faf1e149eef70dc39b511ff58f489525c8f64e206ae008273978a9bc412647a","sha512":"c0265c5788ef8f93a93a3cf69dd66493f647fd84ccbf693817fefc0c7b64b26d2282574890787fb9a3cc0541ffd0e6fbbbe9e03308cf04483b801445b4338235","ssdeep":"1536:f/Uifm7kUdwddCri3iLc0Lg261F2BBCrikauV3cGiH27PNWE98MGfU0nPROpmi0U:jauVLmi0V0d+tKaK","tlshash":"e6a399b2e56710cc7363c22692c1faac1029e370c757caa6f827767d4bc25963562f9c","first_seen":"2025-12-19T07:47:26.371188Z","last_seen":"2026-01-16T01:10:38.050486Z","times_seen":2700,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/api/transactions","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:21:09.641Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /api/transactions HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: Basic Y29yZTpjb3Jl\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:21:09 GMT\r\ncontent-type: application/json; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\nexpires: Tue, 30 Dec 2025 17:21:08 GMT\r\ncache-control: no-cache\r\nx-cache: EXPIRED\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BfB8UzBgzZGpckRzabzF7mDr%2BH8GqEY%2F7qrCcYFfphoj3lWyfAUNuRiH%2FFrkatMjXDp6BujUkl9ODzlqJDkyL6cwHGNhdu%2Bsl9g%3D\"}]}\r\ncf-ray: 9b6336434f244c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2714,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"29eba73aba8e6ba0db22b3cf65e49ab3","sha1":"fd4f3c22cc11c8bbc4005a14646cae38506a97f8","sha256":"b126560feab132e7907334dc32afbfc1ce0d9d98ee34609d0f14386afeeaf9a4","sha512":"dcd30c7264e0a3a458d9871a86ead58be90b2c1bdfc3b38bb802a2d1770f3152cc8cd5490e02c7189d8cb751efec98023f7f2698d9c017e3ed0553e945a9897b","ssdeep":"","tlshash":"e751e1aeeae4e0d1c4cf4fdb6d514d9daf6007ca56ae444d5c87eceb1560920cc13130","first_seen":"2025-12-30T17:21:27.853032Z","last_seen":"2025-12-30T17:21:27.853032Z","times_seen":1,"resource_available":false,"data":null}},"time_used":148,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":148,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/storage/templates/c8815cbee4542d06/d7bd5168e5e71804.png","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.646Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /storage/templates/c8815cbee4542d06/d7bd5168e5e71804.png HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: image/png\r\ncontent-length: 2440\r\npriority: u=4,i=?0\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: MISS\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tRONmFvfpM4bt5KgE2tj%2BaFeGS7tMdY5rtamwvBR8kw3fBuKWSCvO2lOJQBVEAogR9ixTut3%2Bym2%2BCf9leqTRZcg9Etyd%2Bg80CA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b633604cd8f4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2440,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 185 x 50, 8-bit/color RGBA, non-interlaced","md5":"fc387ae2383b726bf6129fa64564efef","sha1":"2102a779fb2bcf4330f69861b212ed3a745638db","sha256":"e26180bfec70f745f8ce23781c09cee4b5991534213a3ce950df5b44e981167e","sha512":"f17c15ddf486e4de0ada2d7538fcc32bb1d8fb6bf1165168818017213055969f77513fc70b7516d1bf049a275f35feae1db0342ba0af66dbccb380fbae94a90c","ssdeep":"","tlshash":"86516ded237205a5206fec490c181ddddfe75f4f460ab70a483aa480028b2fc4ba2343","first_seen":"2025-04-23T13:48:55.930884Z","last_seen":"2026-04-02T12:50:24.97703Z","times_seen":10,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":174,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/cdn-cgi/challenge-platform/h/g/jsd/oneshot/d39f91d70ce1/0.3447684221854123:1767112119:XFm7Oc_wGrtyuXRUb_StPk_lbyWCdPD5YQdyb_jpYo0/9b6335eb69034c11","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:56.052Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"POST /cdn-cgi/challenge-platform/h/g/jsd/oneshot/d39f91d70ce1/0.3447684221854123:1767112119:XFm7Oc_wGrtyuXRUb_StPk_lbyWCdPD5YQdyb_jpYo0/9b6335eb69034c11 HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 12147\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":12147,"data":"f8NM52GTSdeYGYChcxLSOoWecMeObYbUx1bcLSdGrbg31UflNeYGh1QoMGL1YWb3ohMe7boX0ZkbPl0gkb102Mbeqbesp1oLeaOw7XeTaP1OceHI7BREQvybGNvKnAGGXSbXWoH6Tbe-$kn2xJbt9DwxxKNG6ptMSsbs+GTn1+N41XNjWbd29Duz6zPbbH493VazhJBWnsSPMbCjcb-MSk+2Ob0hgdlkGfB+E1IO+qiZupIhMbYHcbQU$Xorf38$LbZbI3jZPKJbbx4NzMc2bbKvvcs2G0NMGKI782JiX3NhMbkH+MI9PVTKYiCXTQNbxx81cfP+MbeSfSOocGW70W7aWNbTYobthWFNb1gGAInp9SdNbHavdgvi2q7Hl2H$cK2Y-vnj$Oo3$sSOTgc-v3vM$fTbcGGOhqeVCbGSzf67tXy9Lb996djE9jZNzP7jQE6wfsVNb8MxcbGaO-h-aJBu8MFaMbYqjyp5qNHXUn6nKzCYgfE9jNjutgCtjv7zbe1cC4Y2qPbBv+TcSM5oQV-1YBhLVeZp2Ose6-B1Abo62$L-SOUOGBiyikse7Ukvg2ez$9nkpnQ00sbGX7F5PfgZj-JlgGVFyhlOvaOFoCF$bPMCP1WCExFF8N29xYeg9i9KMxFMVagbTQXP2JI3pDP0bCEDQ8OJNYfMJR40q+riK7xOYrB6b$eqjJ9Vv4kuHyCH$8AMsw9O4xSk9HsQrQ277rGjHUsCfdJLWaHRrsj$48LH$8sCeSeHijJu38xcyG0bbrh+NyLFLrvoNcW0YzNJ6xuMvHwvcObab8PMKtKseZWpV2SkO62nQW2BWCTrM0xNq+MuoJyD9cBuUeMeeYwWzkstWMMaq1r2o1LweTNcecGq8ekTq1US1dTbko1NOePSNcyS1Fa8878-GM7XN2MUT$9VkbWLcHcWM+gqJyGubUPRSNrMAqz0-jQSPa$SNT2Zub$2Gw$IXre6TvTxcJyf9qj+lzcFgkCX7Sv1NIefSNv-CB6-o2xlqkPe8LEX5MRoP7fc$8S4p96xclS85S4e6o9+o4+SOlPxlEku56E$JxlJLGZqU-Zso5qSc2Jvo9LTvwdXHlB1LTv+PzhIAfcPFg7FQ3iT$qGB-lbS7lSJnbh+0GSdxS5M6SF78BGGTLP08qedfLLvktVxdOdc0xPeTqYngd7uySFqSJvGsXr01DPI0AuPqfoIlUSoNcOSMyXQtV7cual+LuUF5iOeqdPN2SZPTn175o9kE8VPC19yGINN$Y25+0YauhKeVtv8tPND-yMtq0dMNovECqYc+kCLOGB7oByMNcK0ysdTMLvNXyspFp0a-NOx+c2plpzW9286S3-yTQOSyiZ1ZxCLcMkubp09PZ7GkjcI2s$LJy8WiJvWCi6S90bXgKZWJvAgWW931rNeTl8Xb8fhyGdNN3pD3MNjsqWWXsNiIpC$IKYv3-3GGGt7eA-L92s1DdDg6NS53dRs8BYRzxkYRNWTgNoho716wxiEJDoElNGFYT6DQlw0Kb+wovVewS9tAwJvx$y3i-EAObA$AvMTddyR2bdRRW1GYMLeLQC5AgJCDRsoLIQNpGnTUexlMnMFbZYCeA0LobUGued8MQEq87OgiPSsXO5d+KsoW2qlfMbfn8SNp2Jy72kbsqctn7bHuFGOtcAczegh93xKucLMMKHd0Yh-z75CxQo5UCONcV9kGx+LdUS++dyx91NxNxGILiu2ugRW-0Lof0IndG85MzgB2ngKeRgWzvnNhy118A8uoIq750K3OL9eqrpd458H0$9iGEuxfdBNZMQs8QG9Sd97bN4+5XtQp9oNkqg+HYRz9E+7MkSO7FX9NGT4zfN1oFyUcauuFVt+pEVTNczx25F8WNM6yMQIjhSjo+o28QE2xsMlgxSJNyxPe7o+wG+92nbPMAlDzp-Sz1rNp9BNzc$WckcIPieqbjFLNcEFrxg$lRzQbJLPbfuPjlx0$g2H4oVtM5NTZ6u59kZL78n0F45teG3GWQ0cbLMBQSsMSNK2B+1GD9szo0FbuF+Sku2hFHoDgLHf7xB81VKyVVKgD4TA7j0PbQ9pFD1N6G+SHI5hFKLKjooFxWpcc$EchjCx6hQwcidkzdIuwWu1QCWcln1qZoMJl+6g9HpFt6hcD+ky9cbx3nTgeazg9469dt0MsWDbofvGwTX6fZw9J5ojDH99$nzA9I2HE2pLPnoE22kBSC10-TKKsBG1UcsS1Sp72fXQeHUYYpyCxKnMwol9ZWO5cDT-U5t6zc7KfxW22RJj4t6TCLgPL7hIczRLRnIuek1AXOCZUr9d7uOqag7gXhznbqEL2yoNvapeGz7GekoX1GN7c+DHIz+LbH2ac+MEQu7GuWl03$ySK1QDK4ex++4Y2K$BkB5dEoqdG3qMW3Yl4olZDy19l+4SkOONGC15MOMbJdoz$OGybr7OSUeaDBHFPj1tkrNPe39CfAhxCzLBekk0ybWR6jVO+U9dSXOLzsK$gEWt3uuu3U9Aq7noOHLin-ZCioP1aNyj2oeu+nUbaVh9MQe9hZENyiE81tzSAcjykS+-KBOLMVrKgdPbNTPHjfMET78Z8t6nVS7N3xHxljrkntE0zauR6zkbSx8df4ejbGN21USLVAN+GYhiqfHhcvJZ$G6TyNnvLQkSLM-xo7u23tFheplUGTXLA$qWbu$jJkzRfuNIGU9dEEnBPWPy7VDNhCohdt4SGGQ--D6gpNZ5wnxTEH1Bsnf4nAZ8Qkd2aeSBO3MuqT517yk15c8KluUewGrRDyY9$MyQhxUOp+QdhrP14s$c8UfNIFXBwc$5u5DeAk11Cpftc7QhNSYzFbZhkMYG0dDi5yosjKROFDkvvVugQXt2xVjX+DUdS$X4Z2iC9SQeVp8kc5eRe9TurFhPHuuBhn3hUzMGZJ3lWyYuEOcMnGsZfvDZL-XCbgsnc8pcOaBt6x0QYPySNQaZc+oYviksB7kH4eSZ2cM7Baq$x+DuCIj29hbtipcNcaS8SRaTK040azzpWeTA32hRfcJYLF0jlPdwWVFAN5J$d+e3-FQ$UE9aYLyfO02EUo+kdnuEl4vZf1728Q0-$HC9Mu78ppYo$gnOjcc4pyxaEAugRdhJcdWzP5EFql-jP+8cyw1Zo+A+rlusyUnj7scM4t3oO2ekKkEnXdLISdTaNAVTHL7q7c0ojzhkUxdS1aZ4DCq+CuzYVo3clbQltY1D+AcSnzeGg9H434tf+647VBhI8$Eto2e40be5FyqfScsf7j8w4yqFs$NOBGzP1$TlK1zrtMIlE0wFDrJq4wPGKgfML1ctpvaoEe-VisgVia1KrDSwvFu5FYKxgrg3gGsNxGLQs0KOBz71D9orFVXL6Op6L1UHikf8T2qFre9MsYyeAgpHHrcJKLGWQ6d7FNBUh4LyDuYi3nJ1nPkaD82DJqpFNTEPVoa9MgD5kcd8x4bi18p8YqVA7PkJMi1vV5biY6HIxeO6nYa$JhuUxbpjkx88aFEjbYd1M6bLNNaRFTVTuXnUc6nGTiLvLuunu9GXkCnhNNuAJgFMEUnb$9xzxFoLLb$XTB2hcxYynWDbuhcPLCJloe$K2LSOGwpFNZM3bh7LskpPxSN1HoHvSqb0xL2eKZFPKYLyb6YNcQMLNWpQd9paHYxFMwb5dRFhGLVoanusGtG1YNGPp4G$GdaD2MEWJayecx0WLaolnEyh$XVHpknjdTNhpF2cF17oktFjY8pnO9sh1yW8p8NwkUbSofa6Jqd4Js7LVQsuFykd7oH5VJ2PddN8K$DbpzkOJZKhy9EcpDGw09y+GDDybdyFNYaKkoOO+dpcp4+5E$XXHC1kcqdUbJbbXH0Y+HaKueOhyry5s-yNbPS8WT28uWHzNz+bK6yBFx8vLguFoQSrHPL2ELX-DuKZYeY-bvJBpOshJE03xD$e2WxWL8J9aFJyoWNPbFnqdsnMpokoWlxqXLVUcdMf7VGVnCb0n5pZ1SVfK2XecKnN9suAH9TIS9MfJHFdT2KAaWNlYbEfaYLKMokw0TGLJsowKP9-0hSNNhnfaFVEcsbUX3JnMtX1ElojbhytFwFbEbpFJPdJLvbFMEd5EbpaH51lojdJXaHC01NJXKkypkDt9DEpkHDrMGTcG$NxsU7zoR9bjyb6bXD3XI7WNJ+rMNWw05S-nMM5SBSrdvnNjfoE+DMILMYwajawN0TUbvbPLPkCSw0txV8uFpGhOysNa8uHJUbVJZ1MEWHW9r9okNWtMRJ1NwKQSu8uoJbN7KMAocMPS+LYEwjjb-+Jp4b3atLUTjd9pKk5SCL4bnaeXM$ijj98ENzcXt02zdj8urcUbCbnz6EQxMyt9xV6TyuILOoKEvLGERLWpPdA$tjObETTMgDPz0VfyW01Jy9cFN6ZF8pSHUbSpexUc0S1N0EWzx08cz7lJWFhzYsS9d9Ec5LaoOol6OxIuuyka$+s0lnE7Bp2z3pquwSe0rLMEkxWMPzLjR6xG1NbXzjSN3nnMH9jSILJbrJFsXcDGlGEut6k+VpbGR6zNhb08i1i+t6CJiJ6qOoU+5YX09zc76zHD4z87d6yWydnMXVWHp$XMC1yWVahSyy6+zYg$8$k6Wq4p8quXa0xagDZHe7nXUco4fbtbEM7jk0f9$Db7N$KbUk6kbpoqDGhocF-+S4oL6TLyIoWy7Y6T86pxNbNWgbUdv4wJuH3biJo4wEXk1XCbo6x9XkJJvKCd809JlTYDaYe$59UqL93Gs2oNxTwuJXjnto0zO0jGk0dzfabudN6FIbfFVpzoY7rcCLTLJMzpeaKxPHZJIM8yQzF73Fp4Z$w0$nhs37YDzV3gPa62BFIJ-470ncguKbopFS04FNtp89S2JM7XQyWN9DaoFs9yskfaU4qjJ$LsnOpN-MUbCuTM2G0s1YMEAgBsNWTL0TauFoR+okEcqb2qb7Y6AHEYccWDZHlY1zbK0nRXGK7bagyoVVJ9lDQLEc8kDoJbh+ssMEHc4cPb5qDovg7xboenocQqc9ecqJkjOgk084TXt6KkPzAV0gDG-+D1NcT90g6TbJiYffsgo+S$In3fxYE0ysyx-+D$bMInA4P6+lLNxYbXAO7JEMofWHNLhaogakZn1jAFr+XkoWpc2HZqWScTXkyfM4i9BFegKu2de0tsboNfIFVcBFrM$oiEvsiKybGJCdB4hK0lW+iChyuz7C9S-Lc0-pc6R96l6TWHuxxYPqJqWHNgxX9K8pKEFMnMD66fw+LJRJ8afbWMNLoL5lEc91VlUlyWGaZVyWX9zTWDKjLqfaEc0+fqq+2d5b8Xk0J6a0fabLbucuybAGXznJczcX9MWXZKZHiTPL1lQSf1QYX6Tl9aiHaxZ94G-+MEIkrTtaa+EcxsAVzV9y2f1KafWja9$qVnZnNc1gCbvupLaKWz8YaqGjPVN2bDVgdg4yCdSgcsBToH-JaMoHZC3kXgC1Jdwy9SD$Dj9pzp0DR7xzAK$gzcZ$xK7FWEICoc3WhWh9$9cxSN$GlbOs4Tv$nMgD1+katpD+KyvjRJQdGChLK+PjjsD9JqR93noNZjkEFsCi6K8aZnlp7xElczw0gZkdYLUTRl+l4eh1oWYZyq8pW9TMzSRFr4NWxTs0-LnofTzVQLd0soPJWDyXzVl+PTQpQ+V9jd5C8yJMVxOvKYlbTyvgZnF6CboftxyowxVY29Vo$7t6kp89b9WDhchcQLDaxY9pCZ7dVSOdDMRvYKgKR6WN99ONfaaHBlFMWxv$PkJXbupNFk8OsvJiNbMZf1BpovrM0TPdI04yocJLFupEhyZvCLSNAxqCAXB2WDPzPX-cwzLenfHC9SKk7ZgfMzHgJfZfefD0+ZKcEMKMYa94B7czMvoS6GjgLlBEeJhsCVxp5sBsnzjzL7wqO70TNDMEY7D7J2+naHbfCVJXEz66yoL37MpM74njB7uovbo9fqKkzNKlt6XoSD4b9$cL3yOi2dxY9yFSt09yEZovKzEctu7K2V5zV+Pd9phZzV2y317yqM+TizlGqbZGtLVs7SdMNYRTR4HoIavvNzhjJZzau8B1e34a5MAEt6RGvNXiIF-bpyRft0eZok-JqqJqei+xuuaY-nWLkvtNYXM4bnQdxX2n7e8v63TM43W3c6VfcMWZ9M-4f4RPX0bC2$0$oq34zVrZUZjd25MEU+7xfqY78Ow3lnJMde6bSiYTpjgjyjZq4gB5lZ8uU5fqZHze+CI42VDT8TeP2VN2fpUoEMMEZHyZ4uMJhfJfahcCJu24zZtE0gzHhcME0H$0Y0NMM3DgC1xoSV4zlPVpQdUnGHWGEjvf7p4GD$eLPLvGMvXcr1ZjHKJjkZok+PecA4jKP4-ZNzy+JZ1v9ZPfyj46ecyuyo2jruiVe+b3esDsV3RqW7gzzNdKK0ZzNz84AiKflBrGfp4XPCUHJncDjd3ipH6$NMyv9MBCYG9fNMccsKfaTjlbep-4kKWN3sz7Uo3bxKr1qe51ZLrguuILyCVidNxvnBPLB0LZg9yZl5SC9P3bCMQz4Bf0tcNcBF$NLfIsUMDCLB7xPy8PZ4lJaMg3Veae5YEegDba3xrnYz8KXMdL9MRl9p3e7xEZZenrpHtPSaBfTB0$LC$QXZjTM6iCWHbCcMYzz7uFR0TsT2-FaXcEtZRfQ4Cbe0+BTyNWdK-Fu9JHl06iThl3R6yzby-4+JZsEBTrYa3syM9pkxybN2vT$LJvIGCxyjfjIXJu3xMvx0EUNTU6YzeOau3c8nB1kPTqjpgvPbFgBGCBqruQsDygXk83BXvYqCrviP-+2zMHLH0P0vd0+GFQ+v9aTZ4j1Cu7s0Ya-fdB-qzJzYzSRLMJFMnirPocZxBHkdVcz6qEyoE4Tac5F3cl3WsPjcXM3-q99SajZ$K6eJ8--hLQhLoqK7J7chaiiQ2q$j66Uxal10o0gsnBM3zN1zYMaJ+UcgDo8p83w0t5PKlrFsydpLQdO5jqxZrLTkJZRCAxNguaY4t6t4DUw3UEwsIs7P2GQL7TocI0KFM41vL4XVPzJMte6YD7-FH$Xhb+V8fgoH+Gw3fqzCccweboUvyaWMwK4rkBn+Vcgrli$xiYaHIhwnZ0Sq9PqyR5s2eLXrKtlkbzHy6kJZ3arMqexf8Hz5HNPQUQBTXt9UztCILSJuqhPLiSgZDMM4dNCFxF8RjpVZ8IocClDMEyBa5jbqqvnJAOyZ2Ip7y6taDxOP7sVy1NYaKph1duV$WhINH$w26j0U$p3qeOsbeUqgE59lkcME-zFYTjoM2jP7$KgDoW-MDMLo-FnieQGBsUrEuUwFqgY2KUp0uV3R4bhyAsQodvTvaoSvRLJrYgPLUnwzjrwSxVj6izvz2Veh9pPzEayoFx+o5P8PVVWPMBc0PPWDRkAk2VsqMtzoqGWj-+yfBwIwCRNbxftc2hrU5JUUrkXqLVlvDQ-DoHhy8ALs-jkGDXEc44FAoEBfyf2ztuDR8x8-zkgUx3DMC+My+gokTC3FqGFjcckwrLKs9+CQfasAUX21cVo8a9MuGFvQExJG7MHiteU6Sx0U1Z1NGsxQbfezsGEMDUfE5vETBc4Uk$9sUuO4lvVGTEcnPhULFdb-gE1OfT92q$2LZd4FCbASKd4cOUGuH35wqNroh8PDbDuLG87cSy94cfMdHsv7oFrve8PKuLqx5h3pvVbfMpd7ZRkIOsl8TbuLbOfJvbGU1PbzkncpYq1SR+ls2dTeQNNY8cLaHF+9cZq1FQjbGFuFSd4Ne-5rOZGMDp+SOG1cs+5NKbcy25+oQhGPOXLT1Rb+78bMoWIkNcxlqNjsGLs+N1N-uvSukbNy8fZ19$u2QSDGTTcjGQ6S2QeMOybKgHqeS9SnLLDfab1NoxIz9SSyc9NkNL7yS8gDx9c0WPluzc46Vy+u9Vb$eHubMuyHbYfGM9ZyOeLdbNOa5KnsQhG6bzcdbSdfxueOnyv$wwY7qxQhj+2o9NhedNRxvb+bdlkpUVqxuNdwL0eu2HY91SsZc$ZjfcCYNsQQSINjL8RdF70ujSaFTchN-Vudypoky69NFt+1QXE9lMULJE7DqpQhbsNcMkQaP29GCNdWpoqV11tne8LfFFNUcM1t1q1yO+P-zVeWPHHoDrN0NVPx2ts1Vq+TENabRSfp2ZbjKCVcHNk5yqWv-WH7B8BqQ6zNCUNOoNFbdQWk-Z2yMNunbo9S2bgO8$ob1tk7+Pv9J+VLfjtBG5cJGos5N4W5wv+Mkv9TRnOTux7OXQGed2td1nN98VdiQFLNvaSb7EqdzdDgFTaxC1vBeMo+soNYKYFjQ48TGQdwdh6aSQjG5+9UNF1S5X6QeIbNBNFtNNyMp25GONKfSsNsGa2AcVoG8Tufeq727FaIs6SF5Ixob6MP7ucwdxYv21Lb0O8dzd5PQa+dTnOD92o93uTXSVJOJwMSuXcBytWL85M9n7yuvbrGkywbdSeFSTcxyhchq7BM7uZenykcVRhMSx6y23uH5t$S4eG6OO+ycNlWYEt-c2vebzxtTyhoqBgv7bCOHTkSGiuCjN0319YpK7QSvGVWE86Yoku-Sn1JFIobWZru5LqvlM0TGD4SGuQBfMaKbBdo6SOvgeC$UFTGMotL0lW++dMkMSLeKykdBNthb1tJdbaTGLsEg98G8aQe9LJ71L4CfG7JQ0G8uAhnLGKNtQv9$96Tb1fgu0jjXg2hx+dQD1AS2GTbwbwc1E9+8xZZN$UoNwWeP39O1OWDe99G4WMGbPb27Q3SXd7vLLQoVFqTFNq8F8bfNIM1kkbqE9zoi1Xkxk+h$rvYivpqYtjfS1O5qdsx3xqgYk04Q2bnpPKwcbDbix8GeJK6saQULHb5Yx0n3sx1Xd43iOMpGM9AuDeFGkjHO9CBqy8G$XVzwWvax0GVNLNoe1SALBS41SOUc4BG0o-qWNuxeoPibbbxoVGdMEGgMS-ypvl+Dbh+4so+eBoMx0f+bISzBvjnjv-9T8YMiNeOFYcJSfL+7-0-Yy$1-NWc0bUc+unwz3vVj4GZqhcn40Y95GaLQZhqlVaqbHatLccNf9x9plEjoAolFOtnGj8nbRoa2pBnQGykKXcLKfqy3ib-gcKaaeFgcbt9KvFH+NGa11GqucM08xOR$Sl9wzAvebD$WFNkyq1KzUNNWE8N5nn2QD2cHdwbG3Gq1lv+Fv$rg13IWktP3xC5eWPDSySn4tjdVe-MSSDvsv0ji$AeSxxGbMynXL8u0tWUM6hvW+vb50f$yXFqSZXTMuTwZfY29i2z+NtuBS1ja9yLL0FTF2Z$aGJ+$7PMcLx$1+0y8x+tM3bKcGBqcZ+8bNtM1Cu1Sx2AcbLpokdSxGK25bgP1$fcuKeIG2FLxgVwCboS9MuHbFkYp-SY2IGOKPcs1hhfIskX8KBEu2FBf28TLzxzYH0Gc16FqcvNOMjzvMSYMu++8gFBk5j1Za5c6MxF+87BqZa5vQbo-1J2rfOvdbrGgDx0eP1vaVbRb3rc3CQ5s94+W6pEb7sXQpqy35NNxZjuXdZan+7boTl27eeEGjjD6WTFb5hNOGJ3ba4TlV5EFZFC2bWgOKKoItRBT$L6BTKxQToraijW8rYJKoFu$VJ4n6jl+KpXuk040RYvY01u6a64l3fbCL1ryr9JcDiQzyMs5aQddSVL5bvY$B9N1WqpohNJDrqdW5hUr0rWvYrn4w77Vqcl6OTrnWgqAkG4POfDJcdtx2GncaMr6cJOr7Aa2GWc7YjMtAtkvoOo6LSh-Mp5A4sDqOZTFGwI7M-R456OTJ2bygDXnc9bOT+E+NQw5O56kpSHcxwvhaKcO$6K+EcNxUF7khN+wPJoLbV2k1L6kLosNLRdH53Qz9t5BSgQzyrz9beLNrNB9382b8urShNfMokjl309UV+yT2oW-M5C7wJzp-YF-3EXEqz7nYOrNyF2brWHyTGcG3NXcyzqvYX2S9U1gVTh+QDF+gsxz2uxL6uFwKdpMLnH2gOfdfufMHToaGw6OTiadTGdeN52qr2K0fQeToJ586CSrXOzMcgpxb4MSMpp1jgvZ3LqSZuzb1WYP98Q6UFz9k1Ck-d2L6bLOnzx9VbEx8q5cw9s5tnuEbn8IYEdpQfjvW578lkCynQ7Ob-z+dYyb+T$hU9r9PONDyfCpUbOK5wJC2MHF31sgl0x7p0TGHrStFHOJ4jdSXkMHLNY$u45TH0537LNKWn4gFt8ODIb0h5q4u03jwdhh4h5rO808MH1ynogx2YCYANSOqTvKcL6zTb6xE2h2$xU42HOqfw5e4bvDb+kH0NLu$eadMMw08Gn$IbgzogsncBtNrdWeybWzOTA6OZkDoGcaXDAeGsZuJ4oeAqj+fr7bCuSJ6kO8KgUNWYn4oxNkPbN4+SGB12bSg6YD4gDhh4eLOYDwx0xGUn270agblc7dUu34Yh66p1UkqLKJQo5FHwp+V1oWGSG3U4P$WkuDeOyUe9gUTn6wWyLr7+L+DHr8nXb8vcyIJ2NoOTLKpQnc+zHfSgpYbiUuHpM9MkjT71Toyx6jjHElOzva4nHgyzHKAbo0VUBzPgldE6vHaZqFSAc-M5eQDU51G51pNsiOxoC+W+H9zNYHnzWbvnE0Sn+NgEn+Fq4KhtzWNalzIuWSJ0$6xsjM7DCubB0x62Ha7wMK3-4HjbTTaMd8b5o7Hd6AYJCzUdf-z3zgeY7ttnhxG-L0l9T67wnC5gKH6blTAfZahBFqHE6W0Xgz7YdLPhp$SkKZoF12nuHE6+0VZnt5QoP3kOesEpg2Ey1-x46GsL4twdfo4Hign0KAqNUInYb8oU2Llkw5N-zH56vT+gc0CwnI3b8bIclOA5Fet0PlrViJZ$Rtocxw62Gb1gAxl8XxSlNSyZZajbgcx8fdSLZ+GRw55hqgNSRXOHCcgzGQ+BH3GcHhLE5+eoyH07cnYv415qg9SMpGLE3oo5JlCuV+YGRW-UvYlPSIeZT4OoC3qgQSXhCLR-9DxC0bLClcbK1nYB+qqu8PPMN5gSbzqiuLlwNHj-kB4qLuhhQN08lKhfqE28TOHh$n+OulX2hDC9jLqhh9fg2j7n-73gEx+xLHH52FHZ3YBBfNkKiz+WSnOsDfbkyek+WSnLx-fNkCep6jSgcBYlTkFL5GYfg9xcCQHQFoK7Aoz5NCEka5pyjxonh04esR9k4HxbKh$lCYVjcdWT$Z5FYoVClcgC9vBxfj2HFho3GdEix94EVJ3cnh7-Md2CfnD6-cKGcfBy43Hn2dGj7oQ5SCVaRzpcQnngsC4BkhYOfKuIg5HCPb-hOlC9vfsh4EnX22OQwqVH9bU1SOZptn$rkw06O$OQLh9XpOub1a8L7$27ET8-VwWzT5Tqjq1yElGySbNauxe-Gk4Dsh0hpdE0vb$xuLpVQL1t6-Cf+DDvO9zbbaY91+2aULgz1IBIkdCSsLQZSfvoJbIC87A4Pp7rOZGdWqNXdS8Ga+SGNbbbpUXIfCTbo03OxTb1yKc-E9WT29JQMkx+l1lLf+1j1PG3jebEEs8x3j$PT+1L84-fcbbN6MIOpbq2qMP-bfMUFZLq7+fGGTQSCox2xd9-qLyBMocXk7gNYkBy6ZfO4-PMGcehb4bw7MbGkJGFbbbkvq$xr7bP+qHWaQdGdbFN6KKLnb19PkVnMYKAQBhRl$urBZ4bWcQ3YXGDVeLpKMbfXDrBZYS1t-dQelDrgOdbo$tsel$aVJZIV9u9cQXlWb4bG8et+Uh6$k9+MEF7OtvKMGXViZ6KiDWceryy91L0p4Mx+tobAsRbKa5sWa1$bbGsdFdFt4$bHCbcx3TdIHOGCr7Mnb109IHUMirPM2OSMN9QWbbHEbL1ZO5MnQGBkVGuM0oSsS+k-6Ip+27wzzqwQp+Ro2Ono7uGBEocoNjT0W2hQl14SXVFcNVkQx62K9HWlT+d7ERX$KbuMpYBwz6L+bM1PcX7$Uc$Q9$Wc5HnLcLSs1btBST8EG-RpJQXEaM4bspI2SMbeELGNbVp0b9MbCeo3ddlou0qvjLebWEZN$YD+k5UlbFe0GNF2p1bCSIG7WnM9MfMpMdMGe9IbOwGsuO7pHkWqGUbGseuqHHfWSdlMOabbe1kJibUtKKIq8n$9WQQsoc9l1V+zAJWctvWCbNX+bQ2d8bbqDfecbb"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 30 Dec 2025 17:20:56 GMT\r\ncontent-type: text/plain; charset=UTF-8\r\npriority: u=3,i=?0\r\ncf-ray: 9b6335ee59ad4c11-OSL\r\ncf-chl-out-s: +qSFtE42IRtclA7BScd0BA==$RqPjQAomonajVj7Xtx+1CA==\r\nset-cookie: cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=bullrun.ms; Expires=Wed, 30 Dec 2026 17:20:56 GMT\r\ncontent-length: 0\r\nserver: cloudflare\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=aA8w19RGfvmUcwxTHB%2F8LBVsQ6Zij7ZyVEWd3eYVeDMquNiZmh3k0bKbIh8tyDF8KZ93hmNo8FQgq1wDtpaSWRsSj8LGy%2FIvFvJH9JpqUtwwi3w4san%2BM6z2WxOy\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri, cfL4;desc=\"?proto=QUIC\u0026rtt=3011\u0026min_rtt=783\u0026rtt_var=2855\u0026sent=43\u0026recv=31\u0026lost=0\u0026retrans=0\u0026sent_bytes=23521\u0026recv_bytes=15760\u0026delivery_rate=9899029\u0026ipace=0\u0026icwnd=12000\u0026ss_exit_cwnd=0\u0026ss_exit_bw=0\u0026ss_exit_reason=0\u0026cwnd=27913\u0026unsent_bytes=0\u0026cid=da305092496c043e\u0026ts=709\u0026inflight_dur=78\u0026x=55\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T01:24:26.492937Z","times_seen":17465191,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/favicon.ico","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:57.067Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:57 GMT\r\ncontent-type: text/html\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jJPtXUFmD8O0d9BYc41q%2Bxzp3ItljVoimCo9LAt16VF7HSFbM2jElygELfo11lCCJKNJ%2B1RtEr1gmNfwoB9EUZl5n5BC9VIjKd0%3D\"}]}\r\npriority: u=6,i=?0\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6335f4aa5a4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-07-23T00:08:05.524669Z","times_seen":543009,"resource_available":true,"data":null}},"time_used":79,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":79,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-main.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:57.336Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-main.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 30 Dec 2025 17:20:57 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncf-cache-status: MISS\r\netag: W/\"da5bb1dc647470204df0e49f5afac2de\"\r\ncontent-encoding: br\r\ncf-ray: 9b6335f65faa56b4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":121,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with no line terminators","md5":"da5bb1dc647470204df0e49f5afac2de","sha1":"f5cbf596ca5e4fe208e4c55af6e45b71f9febbe8","sha256":"705186becc9e0a306a6b4867ae2768aa9dd3b8c12393d9f9c52029e9a6fcf31c","sha512":"d9c0eda8c93df421f8147960ff4b00f8eacd8791b8386b020f04d0478c6b7a4328767a82b52b8cfbb7c3a44cb55cec488c2d1008670bee709d67d8bdbd887c39","ssdeep":"","tlshash":"d4b09b6c1057f86955e8064ed3b7f65d1d961050811104301658a1753321143c61c55b","first_seen":"2023-03-07T01:02:45Z","last_seen":"2026-07-23T00:48:08.527916Z","times_seen":91179,"resource_available":true,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-vendor.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:57.337Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-vendor.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 30 Dec 2025 17:20:57 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"3b341e35b39f6195793ecaf5db7c1d63\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335f65fac56b4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":82913,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65472)","md5":"3b341e35b39f6195793ecaf5db7c1d63","sha1":"3ef56ed9ac8bfbf5347dc4592653703f59763083","sha256":"548669d6434f5204dca25b9a6f8a02f63301b8c1b58a717b91fec8b6c2918305","sha512":"6b222121b74ffeabd4de7b69f354ad25283d0989376e8e3f6d97f829e28175291eab0a535ca77c22d3f65595250ad9ad3909525c2eb74bf9783f4955c3d7cde2","ssdeep":"768:kURUFvX9zXAfE4dm9+fuDosXRfMySUHM1ONdYO31hY6d/o6cyO4fefHvSAW64F:kURUZXGfzd1uU+8ODY6JORfHBWJF","tlshash":"b483e6dcb295b57117ab20b5417f050bf33a7815a80ac0a4f266f4da7c7848ea06bf7d","first_seen":"2024-03-08T05:46:53Z","last_seen":"2026-07-23T00:52:34.079447Z","times_seen":64687,"resource_available":true,"data":null}},"time_used":286,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":286,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-common.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:57.341Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-chunk-common.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 30 Dec 2025 17:20:57 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"890a2ff1f0bf72e7b248d102ff79740e\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335f65faf56b4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":240941,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65458)","md5":"890a2ff1f0bf72e7b248d102ff79740e","sha1":"201364499dd1839b7b4c491d89a865cc237063e3","sha256":"ef4ad578694c8fb01728aa2043d57113ce46d562939dad05ae75c172f4c1fb35","sha512":"15211872fb2591548ace05e32ff371957157a3a6f21e980e4f66161755aba29d1f23e53f9794ddc9c098d3e5c19895127f486114cff559ce641ee58298569721","ssdeep":"3072:I4MYggYqWzhT9dyWFW1Wn+fM4fOQcErQYIMPdLMz9o115:kyWFW1W+fM4f8kBLMz9215","tlshash":"c234c69df186b47606a37130501f320af23a685ab45ac494f636d8e1bd789cea133f7d","first_seen":"2025-12-29T13:02:03.600994Z","last_seen":"2026-06-13T18:18:43.537665Z","times_seen":3819,"resource_available":true,"data":null}},"time_used":301,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":301,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-2d224aff.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.682Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-chunk-2d224aff.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"872f914720cfc7b657f405012ea10c8a\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 112911\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335febd09b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18392,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (18392), with no line terminators","md5":"872f914720cfc7b657f405012ea10c8a","sha1":"1bf2386624138057451b1bdd97311e9ce1e7d0ae","sha256":"1a9ec11e322de9a2af57eeffaa69f67b49556972fade1dff81f46664427aeb63","sha512":"5cc6f30901cbb79151b79139f3a8b4e83c7a1b9e170447b4c49d177b1edc77706785552ba2b071c5bd69d95a224a4482f8b6ec7765aa25423ff42a798ec56c99","ssdeep":"384:jqiSR0nIa0kIrCQl2kL3kCwGN//h6LiJq:SzP2DaSLi8","tlshash":"61822ba6f149311bc925c750605f2228b33b19a9fa1ece7df2745cf245a8cc2906af3d","first_seen":"2025-12-29T13:02:03.603079Z","last_seen":"2026-01-16T01:10:38.088072Z","times_seen":1977,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-7941cc06.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.710Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-chunk-7941cc06.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"09a6b2a4fc1400ec37c1115e6aa1670f\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 112911\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335fedd17b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":53530,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (53411)","md5":"09a6b2a4fc1400ec37c1115e6aa1670f","sha1":"d703fbc76276de75b56fad5c189fb663146d116b","sha256":"59147272a66366aa00b1f3771a23f360ee90c3bcac88ad31f59d29562b2d3c28","sha512":"2af2fecb20cad761430bd295a3e8846ad7404f20c9610dc8e20010e4d941b9067a192e700a964b92fccd2289ae4a10eb0e2ae81db8323b49bc3c0543dfe0e457","ssdeep":"768:Vlxfu8+HYUmI+rTRWf2z+y+Um/+VRJWf/W+Hc1lt7Gj67IW8/JGvgLCBxf6stK43:xfurowf20UJWfO+Et7GZrC90k","tlshash":"a533c8c9b2d6f4258763632130af3006f27a4964a81dd155f334d9f6b9ece48a227f2d","first_seen":"2025-11-13T12:40:48.539817Z","last_seen":"2026-06-15T21:26:04.427415Z","times_seen":34009,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/aes.js","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:55.845Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /aes.js HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:55 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 09 Aug 2025 01:23:01 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\nexpires: Wed, 31 Dec 2025 17:20:55 GMT\r\ncache-control: max-age=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=t3dLBubIJnDuRQcn%2FzpEnyomW03DZGQ9TeKd%2Blz0tYjX6FC5BnbSRK08MUdDfPr77TS5G65OMAyPUzGyNjE38UYZdqy28%2BJimoo%3D\"}]}\r\ncf-ray: 9b6335ed09904c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25638,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (25638), with no line terminators","md5":"535ff81ab45764c67a7336a70ee7c7a6","sha1":"c1cdb3fc5b8e033fbc2be2638b6189e9f3a4f669","sha256":"991fa3ac0febff65dd238aa07315e6ccb792fb207828b371de8cb353bd4dd121","sha512":"6d26238586710be6349ae23453c110b7d816cd4c0152f24e7c83de117e52d6af3a1aa66d07e9d9c107889a67d13ca84cfeed8abb2ed3403f4d56621846a4fca2","ssdeep":"768:24ecwcqZhf5pl9hKw/PAMZcaEpcj4JAT4tmMF21:Mln","tlshash":"e6b28bae35b0b47e4e8b7f31394a05e2ac67c521ca8a104df148bbd8e1dc5525978bf3","first_seen":"2023-03-07T12:27:07Z","last_seen":"2026-07-14T21:15:46.210869Z","times_seen":188,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":80,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/assets/c3d90a4372d43ecd.js","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:56.779Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /assets/c3d90a4372d43ecd.js HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:56 GMT\r\nx-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2B5puiScOnI1ARF7Lk8xXInosYyTbMZ38ynSo44ZN%2BNe2r13T9yV90sKN%2FeghisaSJ0rmsAX0WTO01PdVutshfj68SgarhnZysP0%3D\"}]}\r\ncf-ray: 9b6335f2da294c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":300251,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (35917)","md5":"3169c3427cd464a71be90bf15fabb221","sha1":"fb169f8414d35e63e40bea714bdb4b224fb0a170","sha256":"bd54ac978dfba32528ab7be4d596cce9cabbb7ee69051bc0b1f35f1d5a336b7d","sha512":"d36b8b70cbb44fb5fad25e15982cd4b6aaf13b4f9783de988a15cf5efd66a3e7dd2eff7553b7536d06950baa61860f1ec68fdbe0f2ee67006785ac5a705f228d","ssdeep":"3072:yWK5Omb5wO2d3+MhWoDLs/RwaFfq3Sap0xQ/UbvxJ3jEHYxJz72Y/aoA2AzlIga:yWYn2T/M/R9FfqiapX/SvPQAz7tZA2Oa","tlshash":"525438e832d2b06243a75af5507b1006f63a2955380dc4a8f16cdcdb3d7694a92bbf7c","first_seen":"2025-12-30T17:21:27.86241Z","last_seen":"2025-12-31T16:02:29.74884Z","times_seen":3,"resource_available":true,"data":null}},"time_used":447,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":342,"receive":105,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-2d0d2b7c.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-chunk-2d0d2b7c.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"ecc9e5cf090bf5602a01763e2895acad\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 112911\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335fead08b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10938,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10938), with no line terminators","md5":"ecc9e5cf090bf5602a01763e2895acad","sha1":"1d07eaeecb0a31f0d95363694e803282518f81a3","sha256":"1cb6c04d780fb838f64fe8bad72bbc16ff24e2466f9ba3123471321f8342cc0a","sha512":"9ace38dcdfd09222ce1f2536d8e4acc781b0055d6ae35486922b86baa540befc98bd9a5bc67bb00b0ef09b9da16ec97b1fe3b2b676b1403cde8eb2c13981870b","ssdeep":"192:0CFny7CpmxwbZlR1cwr40v0zSrj5D6/L6LvGokD36b4hwseQ:08mChZlRNr40v0GF/LvV4hwsR","tlshash":"073295b7e0a1107ea316871c506fa610f61f6c8ab2161da6b67ab46f900ddcfc065f7c","first_seen":"2025-11-28T06:07:28.918411Z","last_seen":"2026-06-15T21:26:04.407385Z","times_seen":26443,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-2d0aef27.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-chunk-2d0aef27.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"fd334ca02da729de662d9c4f3a3c1b08\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 112896\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335febd0bb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10989,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10989), with no line terminators","md5":"fd334ca02da729de662d9c4f3a3c1b08","sha1":"c4d597fc0b45c88349c9386a1dcd9b743d546d7f","sha256":"ca0743a74dc010d603d8b170fbe2a9df6a0540db8ad2338bac2c26d52a885052","sha512":"df2f6995fef3a464e3105ef05560f3cbab5a2eb6928f878e5c3926fc7682fd5f0e662e5ac1d01628aa7d5c327157c1e9eff0abb9d948f6caab1eb3591a047c2c","ssdeep":"192:kHNM+/RIU9HkC40V2tl+f9lVo7QYcb26o5A8f6uYZvUZaUZSPgM:G/b9HkCreHA87YZHh","tlshash":"fa32d7c6f9c7b9624227524841efa218f73f2a947706dc18f06899f30a948c75077bbe","first_seen":"2025-12-29T13:02:03.629914Z","last_seen":"2026-01-16T01:10:38.090265Z","times_seen":1458,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"wss","addr":"vsa29.tawk.to/s/?k=695409fa3ad48120253285e4\u0026cver=0\u0026pop=false\u0026asver=0\u0026tkn=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InZpc2l0b3ItYXBwbGljYXRpb24tc2VydmVyLTIwMjEwMjIifQ.eyJwaWQiOiI2OTJkOTM3OTgyODgzMDE5N2E5ZDcwMGUiLCJ2aWQiOiI2OTJkOTM3OTgyODgzMDE5N2E5ZDcwMGUtQkhGUGROOTU0WjNsS3lSalRfV0xwIiwic2lkIjoiNjk1NDA5ZmEzYWQ0ODEyMDI1MzI4NWU0IiwiaWF0IjoxNzY3MTE1MjU4LCJleHAiOjE3NjcxMTcwNTgsImp0aSI6InRfRlNxd2hqSWJ4bEVLdy1nXzNBYyJ9.iZmvYoYkziAB1-NrHGPABKr3i6qn0XnWId8UIz7txWFTvgfbjFfAcO7Fd91wMvB3vtXD2poYE-uLHbgPJxyaFw\u0026EIO=3\u0026transport=websocket\u0026__t=PjmHlik","fqdn":"vsa29.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"104.20.42.169","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.743Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /s/?k=695409fa3ad48120253285e4\u0026cver=0\u0026pop=false\u0026asver=0\u0026tkn=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InZpc2l0b3ItYXBwbGljYXRpb24tc2VydmVyLTIwMjEwMjIifQ.eyJwaWQiOiI2OTJkOTM3OTgyODgzMDE5N2E5ZDcwMGUiLCJ2aWQiOiI2OTJkOTM3OTgyODgzMDE5N2E5ZDcwMGUtQkhGUGROOTU0WjNsS3lSalRfV0xwIiwic2lkIjoiNjk1NDA5ZmEzYWQ0ODEyMDI1MzI4NWU0IiwiaWF0IjoxNzY3MTE1MjU4LCJleHAiOjE3NjcxMTcwNTgsImp0aSI6InRfRlNxd2hqSWJ4bEVLdy1nXzNBYyJ9.iZmvYoYkziAB1-NrHGPABKr3i6qn0XnWId8UIz7txWFTvgfbjFfAcO7Fd91wMvB3vtXD2poYE-uLHbgPJxyaFw\u0026EIO=3\u0026transport=websocket\u0026__t=PjmHlik HTTP/1.1\r\nHost: vsa29.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://bullrun.ms\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: 8TtQeoM7XEBUuMc3BsUxwA==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nDate: Tue, 30 Dec 2025 17:20:59 GMT\r\nConnection: upgrade\r\nupgrade: websocket\r\nsec-websocket-accept: w4w6ACqOk5Evd8XNM02uG8BeIe8=\r\nsec-websocket-extensions: permessage-deflate\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\ncf-cache-status: DYNAMIC\r\nX-Content-Type-Options: nosniff\r\nServer: cloudflare\r\nCF-RAY: 9b6335ff6b5c7130-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T01:24:26.492937Z","times_seen":17465191,"resource_available":true,"data":null}},"time_used":551,"timings":{"blocked":-1,"dns":22,"connect":21,"send":0,"wait":487,"receive":1,"ssl":40},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/storage/templates/c8815cbee4542d06/9e6835b968bd8455.png","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.555Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /storage/templates/c8815cbee4542d06/9e6835b968bd8455.png HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: image/png\r\ncontent-length: 3453\r\npriority: u=4,i=?0\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: MISS\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Y%2F1MDvB0kR8kX6Ep7cbm2dfXJr7fegqIgo5M9uZk9R3oMVfHSGp%2B9EemVaVdqZ5l9jXjthDHb6p%2B9tSzYMlZx2F3go3CHuIVMvI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6336043d794c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3453,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 185 x 50, 8-bit/color RGBA, non-interlaced","md5":"9eb77a90a80672b04a78ef593b2715fd","sha1":"05e0c827b8b3da016bab11056c834e5cc4f02a0a","sha256":"da43df49f875974f3e62726d2a04236ea72a4285e001f0b2e06e23d4dd5fb479","sha512":"41c7034d33b870ea372d1f07805794eaf783dc9e001d0495cbda48316452b0ea22ff0f38898c3ccd6aefb3e4a20e212b851be58d269d30c818181333eeb132b0","ssdeep":"","tlshash":"e8615a8b40200d3fcc61a823bad6812c7651953c8865dd5b67d5087a76e2e39ca0c5aa","first_seen":"2025-04-23T13:48:55.938581Z","last_seen":"2026-04-02T12:50:25.00134Z","times_seen":10,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":139,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/css/min-widget.css","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.796Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/css/min-widget.css HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"af9830eef563b4df395870a483ce549c\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 112910\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335ff7d2bb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":36092,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (36049)","md5":"af9830eef563b4df395870a483ce549c","sha1":"2c678a245c7b8984569447c9bbfe182583ef7e56","sha256":"5d919993a3fe6ec4c27ec6696b643900c02b95584a4a21a518eb8809edf12531","sha512":"16416617f0c79b40d196c1a7df699f1e01a130e3df75a4f437b4adfc04fa666ac7987d080bbfe759b849bd81860e6bab5b2af02356a8814f0dd1fa9a64b726d4","ssdeep":"384:uTTacuVZNgxYe4fbgL3w23U3xi7vxEbXR+ziLwH0Lg26/tFTiBB6TX3DYC8:yeyna+ziLwH0Lg261F2BBCX3DZ8","tlshash":"47f2bef1f4b700c8b363c122c3d5f67c6459b770ca86ce92f427666c49e16a63581abc","first_seen":"2025-05-21T12:18:34.219676Z","last_seen":"2026-07-23T01:07:21.817658Z","times_seen":48070,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/assets/fonts/tawk-font-icon-3.woff?55755728=","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.905Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/assets/fonts/tawk-font-icon-3.woff?55755728= HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://embed.tawk.to/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: font/woff\r\ncontent-length: 93868\r\nlast-modified: Wed, 23 Apr 2025 10:39:13 GMT\r\netag: \"07d578c95ece55d04d46b095fa8ab50a\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\ncf-ray: 9b6336003cc15693-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":93868,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 93868, version 1.0","md5":"07d578c95ece55d04d46b095fa8ab50a","sha1":"2d7b26de9cdc4b40d467186de2073e3dd7804ae6","sha256":"4326543bece14c56ef8ba2534fdb356452cb0650bcded3521cb8b09a9b03bd12","sha512":"89124c4f86613c63f43940a6f1914c1eee5ed90129e6aaa2c16ce446fa10581d389f7c77a579da2270125bce585efa07bf4b3e0880d283795dba42ddd9c7b0cc","ssdeep":"1536:daI2Ltj6D4Han3AHZy92Nzi2tcw52LHqH:2N6E6nOM2Nzi2t55gK","tlshash":"b393e7171706ef8fd42589bb684280734de2e901672ee243398b4d15961eaf44ef87bf","first_seen":"2025-04-29T12:23:34.02726Z","last_seen":"2026-07-23T00:52:34.0484Z","times_seen":34698,"resource_available":false,"data":null}},"time_used":446,"timings":{"blocked":10,"dns":0,"connect":0,"send":0,"wait":288,"receive":148,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/css/message-preview.css","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.859Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/css/message-preview.css HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 29 Dec 2025 09:58:35 GMT\r\netag: W/\"81c75a0e54497a15d75c28168b257487\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 112910\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335ffdd34b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":54000,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (53952)","md5":"81c75a0e54497a15d75c28168b257487","sha1":"bee41e283ee688fc5a81c864c771af7766ca85d9","sha256":"e762048b625fa5fd66d8e6a4267da9c5302b149fb3ea06d4ebd943085bb53462","sha512":"34b28938bb4e80eb5c271a7d5233abffd948d538b0a4ebbf2493fd40a146d5a962330cca4bd805e32d3faf444d9c5051d71952887fb2a790b852f31ae022fce4","ssdeep":"1536:fGUifm7kUdwddCri2iLc0Lg261F2BBCsEZf:X1V","tlshash":"cf3322b2f56710ccb363c22292d1f6bc202ae770d746ce96f427766c4ad12a63551fac","first_seen":"2025-11-24T02:42:30.965145Z","last_seen":"2026-01-16T01:10:38.098418Z","times_seen":4514,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/assets/7a62dc129abb7a00.png","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.563Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /assets/7a62dc129abb7a00.png HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: image/png\r\ncontent-length: 25477\r\npriority: u=4,i=?0\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: MISS\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=G7Dmg7SIoDkqvQ0XtIFb5JyWVjDP95Bi1cbQXpevJ5FXRUCrdb7rV4DDhPu%2Fm2YTgctU03LgzOqH1KLE1RrsKurrpgHU5lyGBpc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6336044d7d4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25477,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced","md5":"00716492288b514843cd51595790c4f8","sha1":"95acdbe28a5aa2999227c0706e342585e300b8a4","sha256":"7de5ea62067ff095bb447c068dd04ba536e7939675ff3dee11251b303c0f99b4","sha512":"83e97a2aa135f7c59a44c7965bc3e0f94153c3ac2e7c15163fb784dfe5b1746a9f9fee391de906a26198e151806c408a7368da0d95ad12d3cf7b263084d882aa","ssdeep":"768:oLdd1fEqhe22P8ZYubldT9LOfsSvzoxhKSaU:Zqp2EOublj2107K3U","tlshash":"8bb2e1c4b65c3e71bb3bf0c3657eb5eb8f0b158a6293494195c688c0e48ed52e2871b5","first_seen":"2023-05-05T23:35:01Z","last_seen":"2026-05-27T18:55:48.390579Z","times_seen":39,"resource_available":false,"data":null}},"time_used":265,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":228,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/692d9379828830197a9d700e/1jbd0g5dr","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:56.777Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /692d9379828830197a9d700e/1jbd0g5dr HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 30 Dec 2025 17:20:57 GMT\r\ncontent-type: application/x-javascript\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=7200, s-maxage=3600\r\netag: W/\"stable-v4-69525090bcf\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\ncf-cache-status: MISS\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\ncf-ray: 9b6335f2ecc056b4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2123,"size_decoded":0,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text","md5":"8c7bb3d92d8d1016b79019d95ab35d84","sha1":"65f70720e3ce2209890adef03c48dfaaa6f89137","sha256":"553fa8dbc0e04b510a9902b580af7447f24167b94d53c547dba2e6999a088822","sha512":"f79d701bac9eb4c2a382a6ddb5a0d5ea9dc4ceb8e92c0291ac5ba35c3b92c3d301a469f61c7050c72c04dfa609d4c6890443e034d119cf619fca1c2f1a140ab4","ssdeep":"","tlshash":"5441eed66f8f1862936410dc0cfefe0f747720fa49986c9287080c517a666ad2f8ed68","first_seen":"2025-12-30T17:21:27.870011Z","last_seen":"2025-12-30T17:21:27.870011Z","times_seen":1,"resource_available":true,"data":null}},"time_used":500,"timings":{"blocked":12,"dns":4,"connect":1,"send":0,"wait":465,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/assets/7391f6e410241b7d.woff2","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.693Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /assets/7391f6e410241b7d.woff2 HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/assets/e2e81665a6db4c3c.css\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 11164\r\npriority: u=4,i=?0\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: MISS\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EwlLp4VljbKXtFcxypyWzQMH%2BowuXkWMyjIxcF37BfiT5Yl%2BmCCM8Wwa0Nkq67Eg5Aqax1Wtk4lwVZOYIQ0m3PgEplsKCt89698%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6336051d9b4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11164,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11164, version 1.0","md5":"d08677b723b410a78debca060c4d2ca2","sha1":"f3a899654de0e788fbb550e024f8b4fc084ae295","sha256":"3aa91c51b50b964f0b5bee46661c9d6b6846001def952144cfdf5572c52ae2d2","sha512":"661e8c784f4ff534d4d4dda59a3a378cce5e06d547d6a200d5c28556ee153766e8ddabc28082be94c83d596d4df3e47676081e985da3abaf58a57b27af88f061","ssdeep":"192:cmUiIKljwEqBIWVvrg7NyRcwW5hsjzdFzmPMDkpwkAhCihEP0HqvnVPtM:cXiIImIWhrg7NucwWhsNkAh20HOnV2","tlshash":"0132af562761532efe931cf8a19f64817d0eb386faba073647e6053410e47153a8bdec","first_seen":"2023-04-20T09:23:30Z","last_seen":"2026-07-20T22:48:12.566348Z","times_seen":223,"resource_available":false,"data":null}},"time_used":187,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":186,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/assets/66dcefe3a08ade87.woff2","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.704Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /assets/66dcefe3a08ade87.woff2 HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/assets/e2e81665a6db4c3c.css\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 11312\r\npriority: u=4,i=?0\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: MISS\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WWRzqtKQXRgFMs1dQTpUR6p5hi0nvbSJQcY971Rejd5VtQu9VuA%2BSEcMMO03pleqoqUSASeJSB1KwM4a3T0qxyIDJlH09pIRe3Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6336052d9e4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11312,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11312, version 1.0","md5":"e9f6699730e84f7f4b795b283c6e72b5","sha1":"8612c74b5bc486b8a4f61f7c50abd6298aea07ee","sha256":"c6efaa026081560a5beeb2828f60cf762a8bed346153dd6fc8a3b80b6216881b","sha512":"d0c04d00a01181ae326e0c89ba741fc0cc94613cdd20f849bb33cb6f6cce6efdfec61672c57da9b355fcf5e286d35adb2fb34f342805461784201c5d9563e2b9","ssdeep":"192:fwRTVhz3LhjnPceOMhu86hE/ID9MxmINWsX+ca0hWMQPqBOVejz23QgGo7sAn9WA:YRTV1Lhz0ezu86hEQRAmINWX0ZUqug2L","tlshash":"d432c073e4ab3a2e92854b3c7a55a034b351e816ed71e91b52f4ea4c2033fa755ac07c","first_seen":"2023-05-17T21:55:11Z","last_seen":"2026-07-19T11:12:29.70062Z","times_seen":101,"resource_available":false,"data":null}},"time_used":186,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":185,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-30T17:20:55.235Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ndate: Tue, 30 Dec 2025 17:20:55 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GpAaD9Xeb1d1tOGfkkH423OEE3qQgb7rVaj0ZRGQV1P57IcD4rHroeKWOFgvwINoVidFxvDsXmRyI8eJER8mBtr4EulGV4Ps\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9b6335e9582156a4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1843,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (1843), with no line terminators","md5":"487e05233f113d29692db1280dd21156","sha1":"2fda8a1f9240ad756ed736d502c35195c3dd17d3","sha256":"cf1481cd229292d1a199a150a84a891af826641fa698e7d21798e29ed6f77bd2","sha512":"d5eeb0566f00a8f241edcd8e809475dac6ee7844fd2bd87d6938b99c92d3e2e11b3960fb12e75e53ce5ce8c3804f15e32528637891b8f8e5eb00c66b1fb52ea0","ssdeep":"","tlshash":"aa3120397d22d5249ac500a610bae76d39715162bb02c484d1ddc8294918fda5cafcaf","first_seen":"2025-12-30T17:21:27.873601Z","last_seen":"2025-12-30T17:21:27.873601Z","times_seen":1,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":21,"dns":1,"connect":1,"send":0,"wait":91,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/css/bubble-widget.css","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.848Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/css/bubble-widget.css HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 29 Dec 2025 09:58:35 GMT\r\netag: W/\"ce7c2f1d3256f84d0760bd9f400963fc\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 112896\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=2,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335ffcd32b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23063,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (23017)","md5":"ce7c2f1d3256f84d0760bd9f400963fc","sha1":"1375bb0f0223b374f9805cb441970de2cb004591","sha256":"ff92cac16c5ea67e7df480d38f6fd806385a85e69d13da5317ceb3acc469af62","sha512":"3f33f2cf811797404a3bdd12ab6af60b5356bdd577c82e8a97ad7d4cf81dcd1b24bf87c1256e175a6ae6f44d0d2f9c9daf8c29316bc60b370288f98e78e5716e","ssdeep":"384:Wgfco+ziLwH0Lg26/tFTiBB6TXngxYe4fbFU3xi7Ur3K:B+ziLwH0Lg261F2BBCXrsr3K","tlshash":"efa2dbf5e47b10d87363c02293d4f2685499f370ca8adea1f52b661c49e52763682efc","first_seen":"2025-04-29T09:54:46.086393Z","last_seen":"2026-07-23T00:52:34.10268Z","times_seen":37631,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/assets/images/attention-grabbers/168-r-br.svg","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.883Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/assets/images/attention-grabbers/168-r-br.svg HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Sat, 22 May 2021 07:25:19 GMT\r\netag: \"f66e029841759471d2ec78b86760dca7\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 902287\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6336000d39b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22356,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f66e029841759471d2ec78b86760dca7","sha1":"d9db67738984efee3dd63cb144759ac0521c7dda","sha256":"5108ef00c54e1f6ce859852834135447457cf19ee19aa7b0fb55b64b425cb526","sha512":"56ec42c707f42339dc21f9bbba6465e75fbfb92c42b4ea180c7f18120e522284b1fa792c63a214fd472ea47f93203af98ce67cc06ac317d945e619e3ba4e87eb","ssdeep":"384:yNDpPg81DH4/8j2CDFmKIk+pv4osVQ37MTNDsPa2vFqrXdCImKkkppDX0skQ3sdv:gDY/mxmKSpv4HQ3YcvEAImKJpDXGQ3sR","tlshash":"83a2243d46a0c3fd9ac5d2fdaf619068904da0ced1f7c74283e6869046e39d9f20d4ea","first_seen":"2023-04-11T22:59:01Z","last_seen":"2026-07-23T00:33:25.69214Z","times_seen":38694,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/storage/coins/3cedd2bf22772f6e.svg","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.571Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /storage/coins/3cedd2bf22772f6e.svg HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FY3Ft7YMGqGhKDsQoE44B5VdPu5wSbVqje9LtNVPg0DJA%2FhMxGqBQfGB8gGZ6dr2qzwESxjiu1YEnPU0j0mZh48g1aDrfM8dJyQ%3D\"}]}\r\ncf-ray: 9b6336044d7e4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1482,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d1bc01539433112b8258c192aa91baed","sha1":"e26e03f2eba1260c26575bc564c5be8c15ca3aed","sha256":"dd9daf5c8a5ef27b54f2b7ae0094ee0d90d10a5b9f95625d87ce03d99f149c95","sha512":"dd5f467b04b656f88a0234d5ef6213da02a6fddaf0b36e7d346ae7d0fb8f292912051076681d670b912693c42ce0d6fb1b90556dd76b6080a61b3647bc1cf2b4","ssdeep":"","tlshash":"5931429292e6b3bcd109d370912ebc393dd65cf53604c12d06c95692a63249e48efcc7","first_seen":"2024-08-20T09:13:27.28154Z","last_seen":"2026-05-27T18:55:48.392208Z","times_seen":26,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/api/transactions","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.730Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /api/transactions HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: Basic Y29yZTpjb3Jl\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: application/json; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\nexpires: Tue, 30 Dec 2025 17:20:58 GMT\r\ncache-control: no-cache\r\nx-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9b2ZuDAvDNpBU0tJe605tnl0Dw7FR5Lv9w7hVCInt%2BT%2BAEh1zVpjodVb%2FHRrGHdh3sUHN7dZLZHjbYtVjP%2FcDVHSwVtNbGQHz54%3D\"}]}\r\ncf-ray: 9b6336055da54c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2714,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"3a82966f4352349e9774a15332a69e5a","sha1":"f0f64b62ca0c7008613f0bba8df981e708ce4679","sha256":"ada0d8b7af40f19f4ffa60b45ce56039f7570d64d65572c3259ba04463f3dd52","sha512":"065d220184a4ea56d2e6dc30e666d0aa63c4c36736936a52ad2935d9484cec071eb77b15fcc71b0c98d668e7ff8bb838a3462f13fe52904040e49a1effe92f01","ssdeep":"","tlshash":"b05100aeeae5e0c1c8cf4fdbac514d8eaf610bc9566e158d6c87ecdb1560d20c803530","first_seen":"2025-12-30T17:21:27.877773Z","last_seen":"2025-12-30T17:21:27.877773Z","times_seen":1,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/storage/coins/46c2731ade9b683b.svg","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.762Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /storage/coins/46c2731ade9b683b.svg HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: image/svg+xml\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x5VpHn8Vm7WDJDagIP8EjSIBVDmmexM27xneEOAeECvkySnnzyY%2FuqD9AsePGFAcZCbT6zC93nHWBaefhKDlnB0h1ektWU9BQFs%3D\"}]}\r\npriority: u=3,i=?0\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: HIT\r\ncontent-encoding: br\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6336058dad4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":812,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c3e653b491248f87f7d445414fa05230","sha1":"c5fb7624d63c2c868e787fbd9c429563349fcb4d","sha256":"56d411ae3e56d78fe8ea022824da86f7cc3155533b7909182a507199b401b9f4","sha512":"1cb05dbcdbbee15b21341b72a8aa91b3444ff34d05ddba22f69e27bccc9e790fb68cbdb7e53810aba436adde75e69829c6112272ec3c35b86682c91d94c978ed","ssdeep":"","tlshash":"7e016d50125897f54a04434cda5eb07d987260c9a9f4c0a194cbaf3ff860eab0dd5ecb","first_seen":"2024-08-20T09:13:27.284188Z","last_seen":"2026-05-27T18:55:48.408478Z","times_seen":27,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":77,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/assets/audio/chat_sound.mp3","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:21:14.174Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/assets/audio/chat_sound.mp3 HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:21:14 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 6687\r\nlast-modified: Sat, 22 May 2021 07:25:13 GMT\r\netag: \"55342729bd838d323e62cd653754b56e\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 552668\r\ncontent-range: bytes 0-6686/6687\r\ncf-cache-status: HIT\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\ncf-ray: 9b63365f9885b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6687,"size_decoded":0,"mime_type":"audio/mpeg","magic":"MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Monaural","md5":"55342729bd838d323e62cd653754b56e","sha1":"bf0d5edf44a931711804b5208a08cb17b7cb4b4a","sha256":"080b933225d445901ca6b5bd03f7b660339aabc98da5547f21186d95e6022b9a","sha512":"e57274afe1565d2dac2b7b8c9e770d8c0980a4c73ad6c500e807d5ad5412b7e69b47b2633c265bb6318bc52b8a0cc4ce27ae15ed4ea25846dea7ff6eb9de579a","ssdeep":"192:cpPy6gATP+FOQSRa40jQK0MnHq6tcwYY1g3:4PZTGkb1DvMnHq6uVig3","tlshash":"9ed18e7e8d839d11401bbfd5aa8f5aca24625cc7c939d4fab0d0c05025a8edfb8c229d","first_seen":"2023-04-11T10:21:58Z","last_seen":"2026-07-23T00:17:23.074221Z","times_seen":654,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"va.tawk.to/v1/widget-settings?propertyId=692d9379828830197a9d700e\u0026widgetId=1jbd0g5dr\u0026sv=null","fqdn":"va.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.157Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /v1/widget-settings?propertyId=692d9379828830197a9d700e\u0026widgetId=1jbd0g5dr\u0026sv=null HTTP/1.1\r\nHost: va.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://bullrun.ms/\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: application/json\r\nx-served-by: visitor-application-preemptive-7jb5\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 3600\r\naccess-control-allow-methods: GET,OPTIONS\r\naccess-control-allow-headers: content-type,x-tawk-token\r\ncache-control: public, max-age=7200, s-maxage=1800\r\netag: W/\"2-5-0\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\ncf-cache-status: MISS\r\nserver: cloudflare\r\ncf-ray: 9b6335fb7c0556b4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3049,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"0b0ac39f15dbbecb1a90636a0cf1c673","sha1":"71e71d5d69a57078760a2a6aec6f188bdfd18dd0","sha256":"fc6e3a2c1015f0f17c16dc1ba03032d08caf030b5c72d0cd1a21257232089e41","sha512":"e68fe81c1aa3b7f0de0bd660afa2e780670e9cf1cc46277b2b45e245769fb735c6e3187670ccd400736e2fd1ce6ed35291af499018c641568a4e43a900826620","ssdeep":"","tlshash":"2e5101298916dd395389d24775de3623b93dd127e388590de09cad3c83efacd221278b","first_seen":"2025-12-24T00:13:40.736932Z","last_seen":"2026-02-01T20:56:35.326098Z","times_seen":5,"resource_available":false,"data":null}},"time_used":490,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":488,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"va.tawk.to/v1/session/start","fqdn":"va.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.169Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"OPTIONS /v1/session/start HTTP/1.1\r\nHost: va.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://bullrun.ms/\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: text/html; charset=utf-8\r\nx-served-by: visitor-application-preemptive-6kzh\r\naccess-control-allow-origin: https://bullrun.ms\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 3600\r\naccess-control-allow-methods: POST,OPTIONS\r\naccess-control-allow-headers: content-type,x-tawk-token\r\ncache-control: public, s-maxage=600, max-age=600\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9b6335fb9c1056b4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T01:24:26.492937Z","times_seen":17465191,"resource_available":true,"data":null}},"time_used":160,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":157,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/assets/452d25071bacdcd1.png","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.691Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /assets/452d25071bacdcd1.png HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/assets/e2e81665a6db4c3c.css\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:21:00 GMT\r\ncontent-type: image/png\r\ncontent-length: 728097\r\npriority: u=4,i=?0\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: MISS\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zhs9dySbs5DnjkmC0knwHkIt3V0DflYdvx%2B2%2F6CeZYM%2Bm7BTFtpBp7F4nXz0uQhbDMJ%2B6fnJPnehSSY7MVN72kKIlUBnvdS62iA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6336051d9c4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":728097,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1600 x 960, 8-bit/color RGBA, non-interlaced","md5":"4c0532d936f063e7393ad7a8359b0de1","sha1":"f9bd67badbd9d7d011286fc19f237a2a2ceb0773","sha256":"2ca325c5dae0c37bce9289835f404b6f8e3b68173d43600e593c8e22e87d9485","sha512":"96ec52961847d01d52f1e44cac22232d2b034745d4adf6ff4bcf795ed30f068f6292a08eb22f591cd6cf0b27abc93268bc1559382f3cc6b32b5ef205d08c6f77","ssdeep":"12288:0S4NzRT0tt1Tt8Q/Y/Zvi1NzV/c/5Yf1nO0bCk0/MpvQygtHEUSxmOubkF:0zqtPuv/Zvi1FVkG0SvngBEUSxmObF","tlshash":"26f433e661070a04537eb383fb07a4030964358f7ab7a7828d41a6fdc7b7dc8a6d15b6","first_seen":"2023-05-19T22:19:34Z","last_seen":"2026-05-27T18:55:48.385799Z","times_seen":24,"resource_available":false,"data":null}},"time_used":537,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":327,"receive":209,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-30T17:20:56.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:56 GMT\r\ncontent-type: text/html; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jYwsVD%2FoWD1EKHR4ICzZrC3N0LHLbuo2wFwFjGcNGv4PVgmfZ91OSkUu6WohSaB9%2FhTLiWO16cwL6CWMfPaDE%2BKuUb28XqBdNVA%3D\"}]}\r\npriority: u=1,i=?0\r\nexpires: Tue, 30 Dec 2025 17:20:55 GMT\r\ncache-control: no-cache\r\nx-cache: MISS\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6335ee79b04c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1019,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (393)","md5":"8175061d58e0d02f2124ca723caa83a0","sha1":"ae1e829cab6d118135b0667cf2d5c0569a4ca362","sha256":"5efec17b7787fea91202024ae17bfc452e7f24d80159a4364b8e96ef947852b1","sha512":"f75cbf3b0c9d9cba05f7c6dd6e28aceeb7dd328b22110e9870999f010229834cc250494ced7f313b2dcc34aab111bc128a22dec6f18c80dee1217463ea50cae0","ssdeep":"","tlshash":"e1110e4a2ca29c266256479664f1fa0c35d2f251926cd94079de84aa6f00fdbcc8793c","first_seen":"2025-12-30T17:21:27.883901Z","last_seen":"2025-12-30T17:21:27.883901Z","times_seen":1,"resource_available":false,"data":null}},"time_used":375,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":375,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:56.487Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript\r\nexpires: Tue, 30 Dec 2025 18:08:56 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p9UbIhptCj7G4KasfYjXUeXSQsUGuivRuuLm714fI1jO3%2F1qY%2BEKA12oCGxrTHFvYt45dhCGDV8MUSnLVTAtFFeMWUxkl9SA3aM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:56 GMT\r\ncf-ray: 9b6335f109f34c11-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12332,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (12331)","md5":"88a769d2fe35899fd45a332a0a032cc0","sha1":"514c6c1d8475d17e412849a4c90159517d0fa10a","sha256":"ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142","sha512":"756cc5cd029fc4adc9100d0da2f2b0efb3df0f2bf894fba2824019832fea594edd40a238a5ffacc205572cc0155f5632d70f54e37edc0772460f44c69cb76ab8","ssdeep":"192:3dArCS2Z+j/yQ9TCQxUhW2DPY808LE676SbHDc/7uN0VZG05w:NHSG+j/y2xa3bn7Q+0a0O","tlshash":"7442b79c7e95ba30079b91b1a17ff30f6276605a640bc0a0b05ddcd1a878d8d192bf75","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-07-22T23:47:11.845311Z","times_seen":121812,"resource_available":true,"data":null}},"time_used":3,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-2d0da3af.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.700Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-chunk-2d0da3af.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"3b4359ddef38a38d73a020b75ae0eada\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 112911\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335fecd10b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14213,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (14213), with no line terminators","md5":"3b4359ddef38a38d73a020b75ae0eada","sha1":"8e430241157a3618237b94786f71d90411366b1e","sha256":"98bdb92efa9cb16b3faa6adaa13629dd3b1f800222e07fcf8087c3d3a46c3bde","sha512":"1f56aeb2f726daed834534a49f0bdacf24bc6e0da191562c4bd3fb7c575ae30413c869800cb07dda184522bf23faec3c375270f685d916c4aa4d85160dc189ad","ssdeep":"384:UJw/U5YK8Hx9KJNThWazJbUZDkM0kWEYPk6F+UtKM5eH:6+9KJNThWazJbUZDkM0kWEYPk6F+92eH","tlshash":"0352c6a7b2a4782d42379712308f3205f33b7d45b215da19f36edcea4aa84c16056f3e","first_seen":"2025-12-29T13:02:03.587693Z","last_seen":"2026-01-16T01:10:38.073094Z","times_seen":1791,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-vendors.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:57.339Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-chunk-vendors.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 30 Dec 2025 17:20:57 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"44b9fc99078bcfe4490fb15034bc1e15\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335f65fad56b4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":324110,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65465)","md5":"44b9fc99078bcfe4490fb15034bc1e15","sha1":"ce24732180436c239c9f7b652793636862abc0cc","sha256":"b3b902e256ff96b3cfb1ce9f97156c7c2ed18a316f2db4328df5ecbffdebe765","sha512":"6dd243ad3d514c4c174dfccc05d61de84ef7225c808b06be721ac89087cff49b3f643654a6739273bf437f20208ff2b0031552ac2f1a9c81b549cb6fad720ed8","ssdeep":"3072:NTX1gABPVhOj6y1ekyYadM/9LJQMoZm+odXsJ5Ar6VKkOPmx/:FGABPVhO5wdKJCMo4sJ5Ar6kOx/","tlshash":"ea644bc8f183b0b606e6a1a5009f5207737a151968ed8498f574dee968e8e5c633bf3c","first_seen":"2025-12-29T13:02:03.642071Z","last_seen":"2026-06-13T18:18:43.524898Z","times_seen":16307,"resource_available":true,"data":null}},"time_used":448,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":448,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-runtime.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:57.342Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-runtime.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 30 Dec 2025 17:20:57 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"91fa452cb811ebfd42913ed7aea74006\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335f65fb556b4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2306,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2306), with no line terminators","md5":"91fa452cb811ebfd42913ed7aea74006","sha1":"060bc71fe2e4a1f9c98df43b6aba2b2687e12d90","sha256":"624283bdfab2d0b2de4ed2d5e1c443fc4ee513b426345414e625a8d69a058674","sha512":"c8a8fe4bf2b22533178ec9c9be10d7ea9983058b49b5c540bc481621df9e1dafd257e753546e4ce3ac231caae0f86e2e05fc4a3088b78e369607031b07d289f0","ssdeep":"","tlshash":"5441b5d936e4f9ba834328e1043fa016b6353836487be8c0531dd8f5bc38c45811afb2","first_seen":"2025-12-29T13:02:03.646562Z","last_seen":"2026-06-13T18:18:43.504645Z","times_seen":3819,"resource_available":true,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/storage/coins/46c2731ade9b683b.svg","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.573Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /storage/coins/46c2731ade9b683b.svg HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: image/svg+xml\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gybpdDFDw2Gq3z%2B82Y%2FJF58CJf4S40%2BpxhTFNN6yGmHr3ChJDIyCPpglnkF2kyMsvPfKAmZYTF893zMjfvqURQ4zbaQx%2BnqYsgs%3D\"}]}\r\npriority: u=4,i=?0\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: MISS\r\ncontent-encoding: br\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6336045d7f4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":812,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c3e653b491248f87f7d445414fa05230","sha1":"c5fb7624d63c2c868e787fbd9c429563349fcb4d","sha256":"56d411ae3e56d78fe8ea022824da86f7cc3155533b7909182a507199b401b9f4","sha512":"1cb05dbcdbbee15b21341b72a8aa91b3444ff34d05ddba22f69e27bccc9e790fb68cbdb7e53810aba436adde75e69829c6112272ec3c35b86682c91d94c978ed","ssdeep":"","tlshash":"7e016d50125897f54a04434cda5eb07d987260c9a9f4c0a194cbaf3ff860eab0dd5ecb","first_seen":"2024-08-20T09:13:27.284188Z","last_seen":"2026-05-27T18:55:48.408478Z","times_seen":27,"resource_available":false,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":178,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/storage/templates/c8815cbee4542d06/4c3ea3442d7f4e26.png","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.559Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /storage/templates/c8815cbee4542d06/4c3ea3442d7f4e26.png HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: image/png\r\ncontent-length: 177877\r\npriority: u=4,i=?0\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: MISS\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9RPTzwHqD5m7zUOBcxh0cEAETaZZfVPe3HKjP2LL7NY8QEdpvhVJZv1G2EYKyKHY6g5FcgMr4OMW1oZ9QyKPcd%2FHI9jKpNuojTI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6336043d7c4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":177877,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"90778133afef90ff141c6a6e03beb9d6","sha1":"3787c356aede63af895d40900d16e9e7a967732e","sha256":"654a1132e2a37d685e211a32ac061e04d92ab0bb8f51460a0a56c8ca90d2cabc","sha512":"9c6ff12430d1ccf7a48311332331907d2e6fc6f41f16ca6a627b2b1e26aa37cc5ba70df8d2c977762ef483c466dc28c542d561ff5594fdb496435dc7e4dc03b7","ssdeep":"3072:GrtaBmT3kuLS6HNHUOAHTxrBNh85NopCaSgOsrJ+D6zm0/wKPWYAnpS1HnLpCum7:E3TDv9UOAzgCCaSBUd/bPWYKS1HnLpCL","tlshash":"630423fa0e9f7c85da09013af9895925263d563d8768126160cf98e9fbcf74c0db78b0","first_seen":"2025-02-15T12:02:14.893522Z","last_seen":"2026-04-02T12:50:24.979427Z","times_seen":8,"resource_available":false,"data":null}},"time_used":396,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":282,"receive":113,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"bullrun.ms/","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-30T17:20:55.563Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nDate: Tue, 30 Dec 2025 17:20:55 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nLocation: https://bullrun.ms/\r\nVary: accept-encoding\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7ZqKC%2BUYAVTUi2W1z1cjaAdKI8Hb66SUTDyZGTwiX3j2yVyWEka1YupX3%2Fvi5HVXGZyQKvDEbO8j15eDKYqlCTMlHpfFMytq\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nServer: cloudflare\r\nCF-RAY: 9b6335eb3d3bb503-OSL\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1843,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T01:24:26.492937Z","times_seen":17465191,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:55.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript\r\nexpires: Tue, 30 Dec 2025 18:08:55 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q2jxV7CYPyy8cuvL1sbdbVAhTjYaW%2BohmrpoCEuDjKgbqlU5lPZgZiJv3mZ5ScokcqaYOnzNibpQXlW6StbZacuL%2BBFRDGQ7quk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:55 GMT\r\ncf-ray: 9b6335ecd98b4c11-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12332,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (12331)","md5":"88a769d2fe35899fd45a332a0a032cc0","sha1":"514c6c1d8475d17e412849a4c90159517d0fa10a","sha256":"ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142","sha512":"756cc5cd029fc4adc9100d0da2f2b0efb3df0f2bf894fba2824019832fea594edd40a238a5ffacc205572cc0155f5632d70f54e37edc0772460f44c69cb76ab8","ssdeep":"192:3dArCS2Z+j/yQ9TCQxUhW2DPY808LE676SbHDc/7uN0VZG05w:NHSG+j/y2xa3bn7Q+0a0O","tlshash":"7442b79c7e95ba30079b91b1a17ff30f6276605a640bc0a0b05ddcd1a878d8d192bf75","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-07-22T23:47:11.845311Z","times_seen":121812,"resource_available":true,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"va.tawk.to/v1/session/start","fqdn":"va.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.332Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"POST /v1/session/start HTTP/1.1\r\nHost: va.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://bullrun.ms/\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 172\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":172,"data":"{\"p\":\"692d9379828830197a9d700e\",\"w\":\"1jbd0g5dr\",\"platform\":\"desktop\",\"tzo\":0,\"url\":\"https://bullrun.ms/\",\"vss\":\"\",\"consent\":false,\"wss\":\"min\",\"uik\":\"cqG38rbaYYFRnkeDtn_nn\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nx-served-by: visitor-application-preemptive-cl0g\r\naccess-control-allow-origin: https://bullrun.ms\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 3600\r\naccess-control-allow-methods: POST,OPTIONS\r\naccess-control-allow-headers: content-type,x-tawk-token\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\npriority: u=4,i=?0\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\ncf-ray: 9b6335fc9c9fb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1024,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c95ee0b1733067c30438a11434a5a9f9","sha1":"ceed2a77d64ea4646913d61af07d775afdf4332b","sha256":"769c3b37a1939d5a84df7eaf729587af3c063ebee5d33dc996903a9502ecc2c5","sha512":"0154972483a9b4405d87b82f2c8aade9ea0163f4521aaa551d80df065eb0561966898640adfe36f6d6209a943aaa44aa1c70e7b3403df36bdaa68ffb35b0de2d","ssdeep":"","tlshash":"281165030fd95e68a4d337920d8a2cf951cca7a774d0807fe5d6ded960a116ca993c62","first_seen":"2025-12-30T17:21:27.890824Z","last_seen":"2025-12-30T17:21:27.890824Z","times_seen":1,"resource_available":false,"data":null}},"time_used":267,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":265,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/storage/coins/3cedd2bf22772f6e.svg","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.769Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /storage/coins/3cedd2bf22772f6e.svg HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: image/svg+xml\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: HIT\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Tgn4rsypEPIX%2Bbmxg9TA7H14kDs1djA1vb1N5OL7BljwYVwldf2NQNn0IlRWvZEVSp5UwU85cx5B4vVH0EjKfOiVQBdkq%2BSjUsc%3D\"}]}\r\ncf-ray: 9b6336058dae4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1482,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d1bc01539433112b8258c192aa91baed","sha1":"e26e03f2eba1260c26575bc564c5be8c15ca3aed","sha256":"dd9daf5c8a5ef27b54f2b7ae0094ee0d90d10a5b9f95625d87ce03d99f149c95","sha512":"dd5f467b04b656f88a0234d5ef6213da02a6fddaf0b36e7d346ae7d0fb8f292912051076681d670b912693c42ce0d6fb1b90556dd76b6080a61b3647bc1cf2b4","ssdeep":"","tlshash":"5931429292e6b3bcd109d370912ebc393dd65cf53604c12d06c95692a63249e48efcc7","first_seen":"2024-08-20T09:13:27.28154Z","last_seen":"2026-05-27T18:55:48.392208Z","times_seen":26,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":78,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/api/bootstrap","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:57.323Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /api/bootstrap HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: Basic Y29yZTpjb3Jl\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:57 GMT\r\ncontent-type: application/json; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\nexpires: Tue, 30 Dec 2025 17:20:56 GMT\r\ncache-control: no-cache\r\nx-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wS2fd%2FYg7iPXPb2b864rlvPYr8jq5q65WDsxI1oN9QxCuFPXfdt1GyLPdXi52IHORUSUW%2B1DtDJgvTbQzvTtoBIZWrIozn1fMcA%3D\"}]}\r\ncf-ray: 9b6335f64adc4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3621,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b0c1fadc8968e7a3a8595aee29f61b9a","sha1":"75163509676b469c1e1ea189a2148e4630c1d210","sha256":"559b8061fde69f829a4b3d68836bed209eb20aad4fb7bc93ddba4ac5f51d83fe","sha512":"35afe439704e674bcf2a430b50ab66e8ff43c317daa674ec8f7be510975c94f29c10c72f86d45e01aac7494569def5fa854f8b8bd75a7c517b7e3ae9fc623f14","ssdeep":"","tlshash":"9471750471277975536b53b87adb2e4540ed1058e6c4863625cfca3c86fcb9cb82bc62","first_seen":"2025-12-30T17:21:27.892262Z","last_seen":"2025-12-30T17:21:27.892262Z","times_seen":1,"resource_available":false,"data":null}},"time_used":142,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":142,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-4fe9d5dd.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.707Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-chunk-4fe9d5dd.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"8249fafc9a9fbe0f75d4bef0aae2305a\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 112911\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335fedd16b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1000,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1000), with no line terminators","md5":"8249fafc9a9fbe0f75d4bef0aae2305a","sha1":"fab6dda0967dfbaf8ba0cfe5cfade8e150d1735d","sha256":"69b650b4d6479fd29987836a9b74147aade85cc9c50024bcacd5dfb2cb793e8d","sha512":"d0bc9a750061e5b4b761db081656b0e1e655126a413aaa22e87ce14cdfaeac34d532acd08eb0d61274707212871f6d84369b8b2a1a6d3e6c3bfd3d4167afa865","ssdeep":"","tlshash":"f9110248f056b8fcdc8af64288df143034627d4a898cf9e6f5f0aad405555ab312bb5f","first_seen":"2025-04-29T08:39:38.372752Z","last_seen":"2026-07-23T01:07:21.821344Z","times_seen":48240,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-6289ff8e.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.717Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-chunk-6289ff8e.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"06b3d1d4768c7fa3c9280fe71898f58b\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 112910\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335fedd18b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":106023,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"06b3d1d4768c7fa3c9280fe71898f58b","sha1":"6ccb7d3ddfad4a07849870168ccfb688d9e68a14","sha256":"35afdec53f99f6cb402ad2b780762bf19ef9ceaaf4c79e9d5b854636abbdb828","sha512":"c9085d5849bb21a33b2823f8ed2821dfbc7634efbb03a8ce0b2a0b6c0e7111cab497b45b25430cf1abac44e2364be2925c42f9810acfc9a3bfff9f759224c9e1","ssdeep":"1536:BigMTWFu196wufn32jGDdgaOFUWbaGlDluK1MFYjdZPkx3u4V5pfYMrlSf:4nmuTilGhmnx3u4V5pPrlSf","tlshash":"77a3096ef091b47d8993d26120af3212f3363d55a919d0a8f234cdf859d89c9a127f3e","first_seen":"2025-12-29T13:02:03.567496Z","last_seen":"2026-01-16T01:10:38.053132Z","times_seen":1959,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-2d0c8092.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.722Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-chunk-2d0c8092.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"573176a5696bc8177ef9cd22d0314c04\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 112911\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335feed19b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5261,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5261), with no line terminators","md5":"573176a5696bc8177ef9cd22d0314c04","sha1":"d2df89ca54fab39b53d35912867df378a296d4f7","sha256":"63ec3e8ad1852f45903471a3c14e92bc8c52d642add091aef6566c845d79ec17","sha512":"0dd9982a020f84f23ffe6a1882d276b587e39d0b9378f0b7f2208d441a0827fac1d819fb315747cd4c7a938fdd066045375c4a57e854f84a265c069635958586","ssdeep":"96:zNC9Hqt7pEma7hY/rcK3JBPDRIv6hJQ7i16p3n4vkjvxQcsD:zKHhNYxLRIvgx43nVY","tlshash":"08b1859af247b456c156225150ef3b1df33a281ca61ccdc4a66565f218784cba077b39","first_seen":"2025-12-29T13:02:03.575644Z","last_seen":"2026-01-16T01:10:38.060616Z","times_seen":1980,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/emojione/2.2.7/lib/js/emojione.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:21:00.061Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jsdelivr.net","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 25 Apr 2025 00:00:00 GMT","end":"Mon, 04 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:DD:A1:61:65:41:D0:8F:18:9A:2F:B3:5C:A4:20:AA:B2:8C:AD:1F","sha256":"20:CE:80:8C:8A:B7:48:3B:0B:A0:F2:AC:61:42:83:EC:54:84:A8:FA:4C:2D:98:10:FF:8B:FA:A5:1D:F5:21:28"}}},"request":{"raw":"GET /emojione/2.2.7/lib/js/emojione.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 30 Dec 2025 17:21:00 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 39460\r\ncf-ray: 9b6336077cd70b3d-OSL\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\netag: W/\"49dda-cp9vjKV4fYl0Ow7X6yf9dkBr+YU\"\r\ncontent-encoding: br\r\nx-served-by: cache-fra-eddf8230085-FRA\r\nx-cache: HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: HIT\r\nage: 831769\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=l%2B98%2Fil1tDJb6ZZKgMyM5%2F5oumJ0n7nFU1z%2Fn6BmmfxzGmBb1%2BEgzpWP6ser61klOGVJEBUXT6%2BF5V9LIxVs8c9nGp0%2BGWzgDzjA60FfnrQ%2FLf9bElzGttBKVxlqIHk4AgY%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":302554,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (32014)","md5":"3ebdfd5d06617d7d3cf6bf6e5c458085","sha1":"ac433f0c7c8c06dbb26a85d08a47eadcf30d783e","sha256":"a642ac8ca5dc75fc2fa88c4c1d54b6f57f2a27bac6a74e15a5667e78f2af8e0b","sha512":"7ea52d1e4cfb1b61b84f58790fe6e1649d22b1b4b854e45df4b7ecb1b30a6b4e2f6366c794c51f5ce605f8ed0e85f0577dcb7d0a250d3b4a7182c3639edae402","ssdeep":"1536:Q/drlyiQh7fh7RqgwkMTyDUV6HeAIDgI9IKQ/d2ffWifirh3dfEm+E5ove:Q/drlyogMVc6FIKV+ZhdfEm+ET","tlshash":"ab646f7d86506deee994902d86db3b4af9883c0493ed1276f66441cb37ba43a33487dc","first_seen":"2025-09-10T06:37:47.236235Z","last_seen":"2026-06-07T08:03:01.010717Z","times_seen":6744,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":17,"dns":1,"connect":1,"send":0,"wait":14,"receive":2,"ssl":13},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/assets/44b50b0a23f180aa.png","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /assets/44b50b0a23f180aa.png HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/assets/e2e81665a6db4c3c.css\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:21:00 GMT\r\ncontent-type: image/png\r\ncontent-length: 734169\r\npriority: u=4,i=?0\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: MISS\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8Pjz3qUd697wQXFZ98gGGBXz%2BUMpgLbMdNZ7488zMWzxkcVVpEuqTQlQY%2BjiWqUlb9hXmPCpTyhAwDEy9KVjyltSiyL1RXYcPKg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6336050d9a4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":734169,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1600 x 960, 8-bit/color RGBA, non-interlaced","md5":"f67f209342cc63e7c245c97487e27926","sha1":"8436c31bafc9ccf3613f9617acf6c890e9528107","sha256":"d4ae63f16af3074de620bf6ce843abe5c47e396c79a203f9f894b4e625ec0318","sha512":"da564ce6daf526aa6b24d857fea9b0c837ac523cc637510eedb2ec51701bd677445e0b478015c8f091fd9b00a5565c2dd9a2058d1948807d4d730828a27bbf5c","ssdeep":"12288:Tp6DTgFFyWYPA9dsBDAQN4NJwGlcauv/vsDkj9sDKb8zrDA0BV9KeF/2OUKul:9na70z6jvKymk8fDA0BV93Ljw","tlshash":"eaf423bb06aca508d6a7c322deb685b2788fccf33515a14f69eb711254fe51c8d27e40","first_seen":"2023-05-07T20:36:29Z","last_seen":"2026-05-27T18:55:48.398623Z","times_seen":28,"resource_available":false,"data":null}},"time_used":517,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":331,"receive":186,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/cdn-cgi/challenge-platform/h/g/scripts/jsd/d39f91d70ce1/main.js?","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:55.883Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/d39f91d70ce1/main.js? HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 30 Dec 2025 17:20:55 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=5VoXAOfypPYCO0uF5v3ffhGyRHMeLeV1cDXxKXfP0DPJaCt2VFm1%2BrcaVHiG8cpGB0nodsFf2iBpltEkqWlYbq4bqh8OtMzpFQyLZwo0Fb%2BRLxJ8BVievJ8XK8CP\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\ncache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335ed49974c11-OSL\r\nserver: cloudflare\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri, cfL4;desc=\"?proto=QUIC\u0026rtt=4271\u0026min_rtt=783\u0026rtt_var=4086\u0026sent=23\u0026recv=16\u0026lost=0\u0026retrans=0\u0026sent_bytes=10600\u0026recv_bytes=2403\u0026delivery_rate=3325453\u0026ipace=0\u0026icwnd=12000\u0026ss_exit_cwnd=0\u0026ss_exit_bw=0\u0026ss_exit_reason=0\u0026cwnd=22245\u0026unsent_bytes=0\u0026cid=da305092496c043e\u0026ts=538\u0026inflight_dur=52\u0026x=55\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10390,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (10390), with no line terminators","md5":"e460b22febff9667dd5c3143d4414775","sha1":"ed3cc1d150f6597394f105e2c116589d05991f50","sha256":"34d9b3fb3dd0d3ddb80c8b7cb7c938dc29f31a81ab66fce7630fc749e3bee288","sha512":"75f080fae0eea2e2dce98d48f5d735c007e329e4d7ead19218432d9757978249165bd9c9eef448112c99d174772a2e7f0f4619ca8f62195de280354bc102e236","ssdeep":"192:oE2nFfMtOFbVDFbqnxadqSddd1uh1M9ITEcthnrtTxTgeV:J2nF0tOFbVDFbq2vb1IG9ITEShJTxs6","tlshash":"b522facd3e8879152450e8a174d7a4cfa9d4ce7fc4442817d20849ec772da59faacdec","first_seen":"2025-12-30T16:49:11.878621Z","last_seen":"2025-12-30T17:21:27.897619Z","times_seen":3,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/languages/en_dev.json","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.166Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/languages/en_dev.json HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://bullrun.ms/\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: application/json\r\nserver: cloudflare\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"586d518585b166811a617b7f5060f71e\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335fb7c0356b4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10639,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"586d518585b166811a617b7f5060f71e","sha1":"6ea81179776e5977ac49304b176923e61409393e","sha256":"2cc3a63ae0b79ab96b21a927c9f9a192ff287e877df5e54ee0b0dbe33debb900","sha512":"df7a3a88b5effe5f52c27897e20995a32973ae1b34aa260e42286833c68838afd61fcd0d4cc057ed5d8c941280e2e5167cdf394add607763363bdc96f4a099ac","ssdeep":"192:ImwHJ/LrnzPLEgVE1iN+xiDgGOy+HpVHnKWyay8V1K5Av+cE:sxLrnzXE1iN+xkDOy+Hp8/5Avy","tlshash":"18224369ce504ea702c29646399f35437624829b1f54382eb78891ac0f8ed6f71f77ce","first_seen":"2025-07-18T03:22:00.530906Z","last_seen":"2026-06-13T18:18:43.529078Z","times_seen":30250,"resource_available":false,"data":null}},"time_used":151,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-chunk-3ea2c7ce.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:58.693Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-chunk-3ea2c7ce.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\netag: W/\"52698c6dc96b5f2bd13e8f921334e398\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\ncontent-encoding: gzip\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 112911\r\nvary: accept-encoding\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: 9b6335febd0db1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5504,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (5496), with no line terminators","md5":"52698c6dc96b5f2bd13e8f921334e398","sha1":"eb0adbc44ebc73775c5cca0a3851e8a6510d360c","sha256":"37527b07ac54a4567d7e23bde1edfde8ed74c4f30402c96fb56f4c0020c6af42","sha512":"032e41ececcfc651f34c235d15953baacb81e7cfaf492dd919c7fca2a7c49d507ae4a60710064c5419df70eb581254058dffbf1d0d4c53ef47d87bce4e036524","ssdeep":"96:60WlCWYW5rugkENQdx0hZUASzpqrcHZ73abT3Qlgjm6i5cCEsK7oGuyGwDf/2/5N:XBTW5qgNQdAR7c573abF8cCEsK72/5N","tlshash":"b5b11982b251b4668ab5380045cf6f07b07baf4f5d09cd50d783e4a3b230c5a9667e8c","first_seen":"2025-11-13T12:40:48.559139Z","last_seen":"2026-07-23T01:07:21.818651Z","times_seen":40631,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"va.tawk.to/log-performance/v3","fqdn":"va.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.291Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"OPTIONS /log-performance/v3 HTTP/1.1\r\nHost: va.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://bullrun.ms/\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 200 OK\r\nx-served-by: visitor-application-preemptive-73jd\r\naccess-control-allow-origin: https://bullrun.ms\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 3600\r\naccess-control-allow-methods: POST,OPTIONS\r\naccess-control-allow-headers: content-type,x-tawk-token\r\ncache-control: public, s-maxage=600, max-age=600\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\npriority: u=4,i=?0\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\ncontent-encoding: br\r\ncf-ray: 9b6336029d87b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T01:24:26.492937Z","times_seen":17465191,"resource_available":true,"data":null}},"time_used":159,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:55.860Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 Found\r\ndate: Tue, 30 Dec 2025 17:20:55 GMT\r\npriority: u=3,i=?0\r\ncf-ray: 9b6335ed19954c11-OSL\r\nlocation: /cdn-cgi/challenge-platform/h/g/scripts/jsd/d39f91d70ce1/main.js?\r\ncache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public\r\naccess-control-allow-origin: *\r\ncontent-length: 0\r\nserver: cloudflare\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=9CaBnygBuQFzx3bVhoPDRZBSgttWPSmNtY4eX7DV2xSlM8WTM%2BvftPz%2BoVv3l7JjQW2L16P4VoP0gtwfHJ58WGQe8Qbjuk1rVtb%2BotFJBcqeZVq0CrDWjcQAFxtO\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri, cfL4;desc=\"?proto=QUIC\u0026rtt=4016\u0026min_rtt=783\u0026rtt_var=4769\u0026sent=21\u0026recv=14\u0026lost=0\u0026retrans=0\u0026sent_bytes=9838\u0026recv_bytes=2096\u0026delivery_rate=3325453\u0026ipace=0\u0026icwnd=12000\u0026ss_exit_cwnd=0\u0026ss_exit_bw=0\u0026ss_exit_reason=0\u0026cwnd=21509\u0026unsent_bytes=0\u0026cid=da305092496c043e\u0026ts=514\u0026inflight_dur=31\u0026x=55\"\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10390,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-23T01:24:26.492937Z","times_seen":17465191,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/assets/c3d90a4372d43ecd.js","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:56.737Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /assets/c3d90a4372d43ecd.js HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:56 GMT\r\nx-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=do2YAUTeXoLLoCOUpreY%2F0unEtIyARTeV9q2dBSGkpW3sRCZF3OHuKm3vFGjHJTXxMIaR7TPFbOAe%2B%2BYce13bLqUVSnSbzl6z0Q%3D\"}]}\r\ncf-ray: 9b6335f29a254c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":300251,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (35917)","md5":"3169c3427cd464a71be90bf15fabb221","sha1":"fb169f8414d35e63e40bea714bdb4b224fb0a170","sha256":"bd54ac978dfba32528ab7be4d596cce9cabbb7ee69051bc0b1f35f1d5a336b7d","sha512":"d36b8b70cbb44fb5fad25e15982cd4b6aaf13b4f9783de988a15cf5efd66a3e7dd2eff7553b7536d06950baa61860f1ec68fdbe0f2ee67006785ac5a705f228d","ssdeep":"3072:yWK5Omb5wO2d3+MhWoDLs/RwaFfq3Sap0xQ/UbvxJ3jEHYxJz72Y/aoA2AzlIga:yWYn2T/M/R9FfqiapX/SvPQAz7tZA2Oa","tlshash":"525438e832d2b06243a75af5507b1006f63a2955380dc4a8f16cdcdb3d7694a92bbf7c","first_seen":"2025-12-30T17:21:27.86241Z","last_seen":"2025-12-31T16:02:29.74884Z","times_seen":3,"resource_available":true,"data":null}},"time_used":414,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":309,"receive":105,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/assets/fonts/tawk-font-icon-3.woff?55755728=","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:21:00.073Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/assets/fonts/tawk-font-icon-3.woff?55755728= HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://embed.tawk.to/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:21:00 GMT\r\ncontent-type: font/woff\r\ncontent-length: 93868\r\nlast-modified: Wed, 23 Apr 2025 10:39:13 GMT\r\netag: \"07d578c95ece55d04d46b095fa8ab50a\"\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nage: 0\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\ncf-ray: 9b6336077d1e5693-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":93868,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 93868, version 1.0","md5":"07d578c95ece55d04d46b095fa8ab50a","sha1":"2d7b26de9cdc4b40d467186de2073e3dd7804ae6","sha256":"4326543bece14c56ef8ba2534fdb356452cb0650bcded3521cb8b09a9b03bd12","sha512":"89124c4f86613c63f43940a6f1914c1eee5ed90129e6aaa2c16ce446fa10581d389f7c77a579da2270125bce585efa07bf4b3e0880d283795dba42ddd9c7b0cc","ssdeep":"1536:daI2Ltj6D4Han3AHZy92Nzi2tcw52LHqH:2N6E6nOM2Nzi2t55gK","tlshash":"b393e7171706ef8fd42589bb684280734de2e901672ee243398b4d15961eaf44ef87bf","first_seen":"2025-04-29T12:23:34.02726Z","last_seen":"2026-07-23T00:52:34.0484Z","times_seen":34698,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":9,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"embed.tawk.to/_s/v4/app/69525090bcf/js/twk-app.js","fqdn":"embed.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:57.344Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"GET /_s/v4/app/69525090bcf/js/twk-app.js HTTP/1.1\r\nHost: embed.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 30 Dec 2025 17:20:57 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Mon, 29 Dec 2025 09:58:36 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000, immutable\r\nx-cache-status: HIT\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\ncf-cache-status: MISS\r\netag: W/\"e736e189edb5d0d9d5b8e7f23dd9114a\"\r\ncontent-encoding: br\r\ncf-ray: 9b6335f65fb856b4-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":151,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with no line terminators","md5":"e736e189edb5d0d9d5b8e7f23dd9114a","sha1":"bcabee193f13756fa9154fc492fe420c47140343","sha256":"13cf82e6f9d48221cd55f8b3c3d206f7bdb83f291034b478e484ccfef7d500dd","sha512":"ea972884c185633ea238bdacea6ac9da0e0e92f88588cd85c214514c3597bc7d811c4dc4cd35b671dd2db97179bedceb38bd5d200abb9653fbcaeac2ca6ec7b5","ssdeep":"","tlshash":"a0c080ac1496fc9c1674154a8377f54a5cd510108055141015d851a11311546560c54d","first_seen":"2023-03-07T01:02:46Z","last_seen":"2026-07-23T00:48:08.490009Z","times_seen":91206,"resource_available":true,"data":null}},"time_used":150,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/assets/e2e81665a6db4c3c.css","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:56.485Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /assets/e2e81665a6db4c3c.css HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:56 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:56 GMT\r\nx-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uzJSwvb2Fqge3cEKprErKTmXEIshOATWfnkSKBzD8kwOGN0OmGVOVd8PcAuUfL%2FpQa0MLDfZ6NKSDN35h7xsB45f1xUKKlTE3tQ%3D\"}]}\r\ncf-ray: 9b6335f109f24c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":40260,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (40259)","md5":"453072168764882ac8f79175ecbbffda","sha1":"1fcb70e66d717fe1185b6271066f28980d008827","sha256":"d8662700d255efcc72b8045bfb9265ff13398beb483698a32106b8472b43dac7","sha512":"547bf49bf9c43aa15d7caa2757e73e37975674ade6c4680b1032a4e4962c035b70f7c25fa4229e8684efcd3ddea254e37c28b2e11e2c5fbfc85ab5e044632b88","ssdeep":"768:0/epThiqLdnMJihoCcZCOud8G8tKS65wqsZQ1G+dM2cl6iCRotsV84sxIKcv4g0R:08iMMJihoCcZCOud8G8tKS65wqsZCG+K","tlshash":"220367597a5ce104be535b4362df2a0c2534b548e530098afe2b31ca1cd5de7ba73fa8","first_seen":"2025-12-30T17:21:27.900974Z","last_seen":"2025-12-31T16:02:29.773695Z","times_seen":3,"resource_available":false,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":229,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"va.tawk.to/log-performance/v3","fqdn":"va.tawk.to","domain":"tawk.to","tld":"to"},"ip":{"addr":"172.66.161.212","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.453Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tawk.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 08 Nov 2025 06:22:46 GMT","end":"Fri, 06 Feb 2026 07:22:44 GMT"},"fingerprint":{"sha1":"80:D7:06:65:13:56:54:73:0D:47:F1:D0:52:10:4E:1D:6C:FF:43:9F","sha256":"91:03:5F:82:EA:3B:36:7D:F4:58:B6:53:88:29:F4:6C:56:48:B9:C0:D3:BA:54:7A:DD:2D:C9:F4:D4:DB:5E:9F"}}},"request":{"raw":"POST /log-performance/v3 HTTP/1.1\r\nHost: va.tawk.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://bullrun.ms/\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 95\r\nOrigin: https://bullrun.ms\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":95,"data":"{\"logData\":\"{\\\"socket\\\":617,\\\"register\\\":0,\\\"widget\\\":2549,\\\"script\\\":1228,\\\"download\\\":1321}\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nx-served-by: visitor-application-preemptive-cl0g\r\naccess-control-allow-origin: https://bullrun.ms\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 3600\r\naccess-control-allow-methods: POST,OPTIONS\r\naccess-control-allow-headers: content-type,x-tawk-token\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\npriority: u=4,i=?0\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=0; includeSubDomains; preload\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\ncontent-encoding: br\r\ncf-ray: 9b6336039dacb1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"fda44910deb1a460be4ac5d56d61d837","sha1":"f6d0c643351580307b2eaa6a7560e76965496bc7","sha256":"933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9","sha512":"57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1","ssdeep":"","tlshash":"0e3000000000000000000000000000000000000000000000300000000000000000000c","first_seen":"2023-04-06T02:18:46Z","last_seen":"2026-05-10T02:19:39.188302Z","times_seen":38514,"resource_available":false,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":148,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/assets/b06689833be91a05.woff2","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.710Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /assets/b06689833be91a05.woff2 HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/assets/e2e81665a6db4c3c.css\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 11188\r\npriority: u=4,i=?0\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: MISS\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=t8ApCnp2aFIVL9HomOkAgE3ViWZPBkSiE0LqkAMavIIMws2u1jnCjznWMGTQcKg3hq3rkqINDnM9eRw9jt9ZofM%2BFLJnN5d2UXc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6336052da24c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11188,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11188, version 1.0","md5":"382dc2eb9467e2812a86cbf07eb4ddc4","sha1":"4d1cd4a4019b29191950a32321c8970faf9b0a8d","sha256":"faf6e6e3573dc6f4be5e7efe63ccd97dbe4b5a63de4ca70f8587566ca91063e1","sha512":"b7fc3a28335d4d632393423099ad6be9484893d9494b2e4ad80117ab8bf93cbb950fa7f9c0ce6784cbe6458967225c612a13d5c057db84ca23d676dc50f439d8","ssdeep":"192:DmIEyFDoLME3JobdVOHIrehMVpQ1FC42iIdaEj3fYSLh2efdhupPp:aYorifdetENiTEjgSLh2eSph","tlshash":"8e32bf9580126271e9095ca0e7be6409c1ba355d3d850a305abdf88660d3ffdf1726bc","first_seen":"2023-05-17T19:56:47Z","last_seen":"2026-05-29T13:50:40.486223Z","times_seen":87,"resource_available":false,"data":null}},"time_used":176,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":173,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bullrun.ms/assets/448ccb0bb6f5f5d1.woff2","fqdn":"bullrun.ms","domain":"bullrun.ms","tld":"ms"},"ip":{"addr":"104.21.34.234","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://bullrun.ms/","date":"2025-12-30T17:20:59.712Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bullrun.ms","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:03:24 GMT","end":"Fri, 06 Mar 2026 20:49:57 GMT"},"fingerprint":{"sha1":"D6:54:0A:90:E1:2D:0B:31:90:45:BE:F7:A8:AE:06:2C:F4:9D:78:9B","sha256":"AE:7D:92:AB:59:FD:F7:F5:AD:B3:81:F7:7F:57:5E:50:F5:6D:8F:32:83:8C:31:D1:1D:42:A9:A6:57:62:D5:D1"}}},"request":{"raw":"GET /assets/448ccb0bb6f5f5d1.woff2 HTTP/1.1\r\nHost: bullrun.ms\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://bullrun.ms/assets/e2e81665a6db4c3c.css\r\nCookie: deviceId=f918b68f0989537d13b042a308a2a5d0; cf_clearance=95xcG6B5k11poPmBjuhiVyjoKWXSt4IrKn9NiAc8Vws-1767115256-1.2.1.1-KweSgfezWbWBdGZo.EiuP2cVu5J0BlvkheL4rptm2D2ziHxUmY32UZLp8JhaNTSpP2ISfEJ.MT79GkAXZ5ZOvDUO3hG1WVdzJzR6JlQIXxZJbtHWSIa14ieFVgvec6jKWcnYqOvx0S_L23q07BTQWKBJfqZnM32ugJM2KCbOGf75UkEigrGnUF.S1j2uHCeCaIFx.KxZGsEQg_fJn8Maa3WpupR2yoNXVCdUXFO2JAs; TawkConnectionTime=0; twk_idm_key=cqG38rbaYYFRnkeDtn_nn; twk_uuid_692d9379828830197a9d700e=%7B%22uuid%22%3A%221.1hHhcI5ssLg4y7p1UAtuiaXHdP2CJeiJC6KcbDwTDhHDQsuSK9ZXhs2ucD38qNCS4nnwkM0r2GQGbOQVdc101kth6mAwdufz6NQhvVWrk8JMmxYgnzH%22%2C%22version%22%3A3%2C%22domain%22%3A%22bullrun.ms%22%2C%22ts%22%3A1767115258653%7D\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Tue, 30 Dec 2025 17:20:59 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 11248\r\npriority: u=4,i=?0\r\ncache-control: max-age=3600\r\nexpires: Tue, 30 Dec 2025 18:20:59 GMT\r\nx-cache: MISS\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=i%2F%2BNojdTowj76%2B68yIS13Y0o2X%2FscWIG9ICu26F6IS4OLUdmu5Fb4n9Ik9wk5s7jEYevmagPbF5utGj6oqTbWggMylt%2FCwlhP18%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b6336053da34c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11248,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11248, version 1.0","md5":"064d2b508dc3ed341323c60729929aee","sha1":"db61c0c0ab7463c4cc3a5240ad49b5d10d4efc8a","sha256":"39a40c3f9c0f4b126a8484a03da4f80f6eee667072e86015a425c814e8843b15","sha512":"b9ac306c27b66175252729cd2c95e8c5431935ce08db7e7f880151cebe2ab1647b088cb98251aaf0cb179581ad2fe5fd071681f78e587b03fcedef5fafff66d7","ssdeep":"192:FVNiMdlSEaok8MU0ssVYTIvevQGQFCPvgZv/mFYydMJwXOFjX0nxHGAq3S2p:TQnqkFs3a/QPvy3OYbeaX0n9yDp","tlshash":"be32bf32b22e5b5d8fbf25f3e7598b1eea824233233b55e4480159d6017e10ab16e1f9","first_seen":"2023-05-17T19:56:47Z","last_seen":"2026-07-08T08:00:15.170269Z","times_seen":122,"resource_available":false,"data":null}},"time_used":185,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":181,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-30","alert":"Sinkholed","trigger":"bullrun.ms","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}